CVE-2026-55423 Langflow: Logout button does not clear session
Attackers can retain access to a user's session after logout, potentially leading to unauthorized account access in Langflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55423?
CVE-2026-55423 is a medium-severity vulnerability in Langflow Langflow, published on 23 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.
Weakness: CWE-613
Which versions are affected by CVE-2026-55423?
3 open source packages ship an affected version, including langflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langflow PyPI | All versions | 1.7.0 |
langflow PyPI | All versions | 1.7.0 |
langflow PyPI | All versions | 1.7.0 |
Products include Langflow Langflow.
How do I fix CVE-2026-55423?
Upgrade langflow to 1.7.0 or later.
Is CVE-2026-55423 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55423 exists.
Other vulnerabilities in Langflow Langflow
Sources
Also known as GHSA-7hw8-6q6r-4276, PYSEC-2026-222.