CVE-2026-55423: Langflow: Logout button does not clear session

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-613

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

Affected products

IBM Langflow OSS: before 1.7.0 — fixed in 1.7.0

How to fix

Upgrade to a fixed version: IBM Langflow OSS 1.7.0. Check the vendor advisory for mitigations.

References

https://github.com/langflow-ai/langflow/pull/10527
https://github.com/langflow-ai/langflow/pull/10528
https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276

Get alerted when CVE-2026-55423 or the next vulnerability affects your stack