What CISA added, and why it is a first
CISA added CVE-2026-55255, an access-control flaw in the Langflow visual framework for building AI agents, to its Known Exploited Vulnerabilities catalog and ordered US federal agencies to patch it within days. The defect is an insecure direct object reference in the /api/v1/responses endpoint, affecting every version before 1.9.2: authorization hinged on a user-supplied identifier that the server never re-checked, so one authenticated user could invoke another user's flows.
What makes this entry notable is not the mechanics but the category. The catalog has long tracked operating systems, network appliances and enterprise servers under active attack; Langflow is the first AI agent-building platform ever added. That is a marker: the tooling layer where companies wire language models into their own systems is now treated as live, exploited infrastructure, not an experimental sandbox.
How a bypass became stolen keys
The security firm Sysdig traced a real campaign that ran from 22 to 25 June, in which an operator chained CVE-2026-55255 with a second Langflow flaw, CVE-2026-33017, to reach flows they did not own and pull the secrets stored inside them. The haul was not documents or database rows; it was credentials - large language model provider API keys and Amazon Web Services keys, lifted across tenant boundaries on shared or internet-reachable instances.
That is the part owners should sit with. An agent builder exists to connect models, data and cloud services, so by design it stores the keys that do the connecting. When the access check fails, the attacker does not get a defaced page; they get the keys that bill to your account, run your models and open your cloud. The exploit turned a low-code convenience layer into a credential vault with a broken lock.
Why your low-code AI stack is now attack surface
The practical lesson is that agent and automation builders concentrate crown-jewel credentials the way few other tools do, because every connector they offer needs a secret to work. Self-hosting does not neutralize that; an internet-reachable instance one version behind the patch is enough, and these tools often go up fast in a team that is experimenting, outside the usual review. The blast radius is every system those stored keys can reach.
For a European operator there is a compliance edge too. Under NIS2 and DORA, if leaked provider keys enable fraud or an outage on your tenant, the incident and its reporting clock are yours, not the vendor's. So the action is unglamorous and specific: inventory every agent and automation platform in use, upgrade Langflow to 1.9.2 or later, restrict who can reach it, and rotate every LLM and cloud key it has ever held. Then fold these tools into the same vulnerability-management cadence as any other internet-facing application.
Read next: 430,000 Firewalls Became a Ransomware Supply Line | CitrixBleed Returns, Exploited Within a Day
