The first AI agent platform hit CISA's must-patch list. Audit yours.

The low-code AI builder you spun up to prototype an agent is a database of live credentials. That's the lesson from CVE-2026-55255, a flaw in Langflow that attackers used to walk out with LLM provider keys and AWS credentials — and the reason Langflow just became the first AI agent platform ever added to CISA's Known Exploited Vulnerabilities catalog.

What actually happened

Per the NVD entry, CVE-2026-55255 is a cross-tenant insecure direct object reference (IDOR) in Langflow's /api/v1/responses endpoint, carrying a CVSS score of 6.1. In versions before 1.9.2, any authenticated user could execute another user's flow simply by supplying that flow's ID in a request — no privilege escalation, no exploit chain, just an ID swap.

The payoff is what makes a 6.1 dangerous. Sysdig's Threat Research Team observed active exploitation with attackers using the IDOR to run other tenants' flows and harvest the secrets embedded in them: LLM provider keys, cloud credentials, and database passwords. Sysdig watched a single operator pair this bug with CVE-2026-33017, an unauthenticated RCE, against the same instance in one week.

CISA added the flaw to its KEV catalog on July 7, 2026, and ordered federal civilian agencies to patch by July 10, per BleepingComputer. It landed alongside three 10.0-severity flaws in Adobe ColdFusion and two Joomla page builders — but Langflow is the one that marks the shift: The Hacker News noted it as the first AI agent platform on the list.

Why it matters for your business

Agent builders invert the normal security calculus. A traditional app leaks whatever it stores; an agent builder stores the keys to everything it can reach — your OpenAI account, your AWS environment, your production database — all in one place, often stood up by someone who was "just testing something." A medium-severity bug becomes a full credential dump because of what's sitting inside the flows.

If you're running Langflow, patch to 1.9.2 today and rotate every key that touched it. But the broader move is inventory: know every low-code AI tool running in your name, what credentials it holds, and whether it's exposed to the internet. The convenience that makes these platforms great for prototypes is the same convenience that makes them a single point of failure in production.

Sources: NVD — CVE-2026-55255, Help Net Security, BleepingComputer, The Hacker News.