Attackers are actively exploiting a high-severity vulnerability (CVE-2026-55255, CVSS 8.4) in the Langflow visual AI framework to harvest credentials. The flaw affects Langflow versions prior to 1.9.1, and users must upgrade to version 1.9.1 to remediate the issue.
The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on Tuesday, July 7, nearly two weeks after the Sysdig Threat Research Team observed it being actively targeted. CVE-2026-55255 exploited Langflow is an open-source visual framework for building AI agents and workflows, widely used by individual developers, enterprises, and service providers. CVE-2026-55255 … More → The post Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) appeared first on Help Net Security .