Is CVE-2026-55423 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55423 being exploited in the wild.

How severe is CVE-2026-55423?

Medium severity, with a CVSS score of 6.1, published 23 June 2026.

Which products and versions are affected?

langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.7.0.

Is there a fix for CVE-2026-55423?

Yes. langflow (PyPI): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55423 attacked?

It is attacked with physical access, in a software library.

Am I affected by CVE-2026-55423?

Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55423: Langflow insufficient session expiration in logout mechanism

CVE-2026-55423 · Severity: medium · CVSS 6.1 · Published 2026-06-23

Langflow is a tool used to build and deploy AI-powered agents and workflows. A security flaw was identified where clicking the logout button failed to actually terminate the user's session, leaving them logged in. This poses a risk in shared computing environments, where a subsequent user could gain full access to the previous user's account, data, and AI workflows.

Technologies: langflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55423 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55423 being exploited in the wild.
How severe is CVE-2026-55423?: Medium severity, with a CVSS score of 6.1, published 23 June 2026.
Which products and versions are affected?: langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.7.0.
Is there a fix for CVE-2026-55423?: Yes. langflow (PyPI): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55423 attacked?: It is attacked with physical access, in a software library.
Am I affected by CVE-2026-55423?: Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

langflow (PyPI): upgrade to 1.7.0 or later
```
pip install "langflow>=1.7.0"
```

Technical details

An insufficient session expiration vulnerability (CWE-613) exists in Langflow's logout mechanism. The root cause is twofold: the backend `/logout` endpoint attempted to delete authentication cookies without matching the original security parameters (HttpOnly, SameSite, Secure, and domain), causing browsers to ignore the deletion request; additionally, the frontend failed to explicitly clear these cookies. Consequently, `access_token_lf` and `refresh_token_lf` remained active in the browser. An attacker with physical access to a shared machine can refresh the page after a user "logs out" to resume the session with high confidentiality and integrity impact. This is resolved in version 1.7.0 by ensuring cookie parameter parity during deletion and updating the frontend auth store.

Affected products

langflow-ai Langflow < 1.7.0

Identifiers

CVE-2026-55423
GHSA-7hw8-6q6r-4276
PYSEC-2026-222

Timeline

2025-11-07: other: Fixes submitted via pull requests
2025-11-12: patched: Fixes merged into main branch
2026-06-19: advisory: GitHub Security Advisory published
2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.