The Sysdig Threat Research Team documented the first known in-the-wild exploitation of CVE-2026-55255, a CVSS 9.9 IDOR vulnerability in Langflow, observed alongside CVE-2026-33017, a CVSS 9.3 unauthenticated RCE. Despite its higher score, the IDOR received minimal attacker effort compared to the RCE, which has been exploited thousands of times. The analysis explains why: the RCE requires no authentication and is internet-sprayable, while the IDOR requires an authenticated session plus a disclosed flow UUID. The attacker's playbook involved enumerating flow IDs via an oversharing list endpoint, then replaying them with a 'leak api keys' prompt injection to steal credentials from other tenants' flows. The post argues that CVSS scores don't map directly to real-world exploitation likelihood — ease of exploitation and attacker effort-to-yield ratio matter more. It also highlights that in multi-tenant Langflow deployments, the IDOR is genuinely dangerous because it crosses tenant boundaries at the application layer without needing a sandbox escape.
