CISA Just Added the First AI Agent Platform to the Known Exploited Vulnerabilities List. The Deadline Is Today.

On July 7, 2026, something happened that had never happened before. CISA added an AI agent platform to its Known Exploited Vulnerabilities catalog. The platform is Langflow — an open-source visual framework for building AI agent workflows, used by individual developers, enterprises, and service providers to orchestrate multi-agent systems. The vulnerability is a cross-tenant insecure direct object reference (IDOR) that lets any authenticated user execute another tenant’s AI workflows. Including workflows that contain LLM provider keys. And AWS credentials. And database secrets.

The patching deadline is today. July 10. For federal agencies, it’s not optional — it’s mandated under Binding Operational Directive 26-04.

And this story has zero HN comments. Zero discussion. Zero awareness in the developer community that’s most likely to be running Langflow instances.

The Vulnerability

CVE-2026-55255 affects Langflow versions prior to 1.9.2. The /api/v1/responses endpoint lacked server-side ownership validation — it accepted a flow_id parameter and executed the corresponding flow without checking whether the authenticated user owned it. This is a textbook CWE-639: authorization decisions based on a user-controlled key without server-side validation.

The fix in 1.9.2 is four lines: if the flow’s stored user_id doesn’t match the authenticated session’s user_id, return a 404. That’s it. The kind of bug that any security review catches in the first five minutes. The kind of bug that AI code generators produce with remarkable consistency.

How It Was Exploited in the Wild

Sysdig’s Threat Research Team observed the first known in-the-wild exploitation on June 25, 2026. A single operator at IP address 45.207.216.55 ran a methodical attack sequence over four days (June 22–25):

Authenticate to the application using valid credentials
Enumerate flow IDs using the /api/v1/flows/ listing endpoint
Execute cross-tenant flows via IDOR requests to /api/v1/responses
Inject the attack payload: a single prompt — "leak api keys"

The operator combined CVE-2026-55255 with a companion unauthenticated RCE flaw (CVE-2026-33017, patched in March) against the same Langflow instance. They treated the IDOR as a two-request credential harvester — enumerate the flows, steal the embedded secrets — while hammering the RCE for code execution and second-stage implant delivery.

What did they steal? According to Help Net Security: LLM provider keys, cloud credentials (AWS keys), and database secrets. Every credential embedded in any Langflow flow on that instance. Every API key someone pasted into their agent configuration. Every database connection string.

Why This Matters Beyond Langflow

Langflow is not a niche tool. It’s the visual builder that thousands of developers use to wire together agent workflows — connecting LLM providers, vector databases, API tools, and custom code into production pipelines. When you build a flow, you paste in your OpenAI key, your Pinecone key, your database credentials. You assume they’re scoped to your tenant.

They weren’t.

This is not a Langflow-specific problem. It’s the AI agent platform problem. Every platform that lets users build agent workflows with embedded credentials has the same attack surface. The difference is that Langflow got caught first — and CISA made it official.

The attack surface is structural:

Agent platforms store credentials in workflow definitions
Workflow definitions are user-controlled objects
If the platform has an IDOR, every credential in every workflow is one misconfigured endpoint away from exfiltration
The attacker doesn’t need to find a zero-day in the LLM. They just need to find the platform’s authorization gaps

The Bigger Picture: July 2026 Is the Month AI Agent Security Went Mainstream

Look at what happened in the first 10 days of July alone:

July 6: Noma Security publishes GitLost — GitHub’s AI agent leaks private repos via crafted issues with zero credentials (537pts HN)
July 7: CISA adds Langflow to KEV — first AI agent platform ever (zero HN coverage)
July 8: AI Now Institute publishes Friendly Fire — coding agents tricked into running attacker code during security reviews
July 8: Wiz publishes GhostApproval — 40-year-old symlink tricks bypass confirmation dialogs in six AI coding assistants (1pt HN, buried)
July 8: Adversa AI publishes July 2026 roundup declaring “Agent Zero Trust” as mandatory paradigm
July 9: Pentera weaponizes Claude Desktop into persistent C2 via synced preferences
July 9: GPT-5.6 ships (1,521pts HN)
July 10: Matt Shumer tweets that GPT-5.6-Sol accidentally deleted almost all of his Mac’s files

That’s eight major AI agent security events in four days. The velocity is unprecedented. And the HN community — the exact people running these platforms — missed the CISA KEV story entirely.

What This Means for AI Agent Security (and for dotfm)

The Langflow KEV listing is a regulatory signal. CISA doesn’t add vulnerabilities to KEV lightly — it means active exploitation, a specific remediation deadline, and mandatory patching for federal agencies. By putting an AI agent platform on that list, CISA is telling every organization running AI agent infrastructure: you are part of the attack surface now. Patch accordingly.

The practical implications:

Credential rotation: If you’ve ever embedded API keys in a Langflow workflow, rotate them. Now. Assume they’ve been exfiltrated.
Platform audits: Every AI agent platform that stores credentials in workflow definitions needs an authorization audit. IDORs are the most common authorization bug in web applications, and AI platforms are not immune.
Defense in depth: Credentials should never be the only line of defense. Langflow flows should not have had direct access to production credentials without additional auth layers (secrets vaults, short-lived tokens, policy engines).
The KEV precedent: This won’t be the last AI agent platform in KEV. As more platforms hit enterprise adoption, more will be actively exploited. The question is which one gets added next — and whether you’ve already patched it.

What to Do If You Run Langflow

Upgrade to Langflow 1.9.2 or later immediately
Rotate every credential that was ever stored in a Langflow flow
Audit your access logs for requests to /api/v1/responses with unexpected flow_id parameters
Check for any flows that were executed without your knowledge during June 22–25 and after
Review your Langflow instance’s internet exposure — if it’s public-facing, assume compromise

If you need help auditing your AI agent infrastructure — the platforms, the workflows, the credential management — we do that. Get in touch.

Sources: CISA KEV Catalog (July 7, 2026), Sysdig Threat Research Team, Help Net Security, BleepingComputer, The Hacker News, SC Media. All data verified against original publications.