The first agent platform on CISA's must-patch list hits its federal deadline
Langflow's authorization bypass is being chained with a remote-code-execution flaw to steal model and cloud keys. Federal agencies had until today to patch.
- CISA added Langflow's CVE-2026-55255 to its Known Exploited Vulnerabilities catalog on July 7 and gave federal civilian agencies until July 10 to remediate.
- By industry accounts it is the first AI agent-building platform to appear on the must-patch list.
- Sysdig documented active exploitation in late June, chaining the authorization bypass with an unauthenticated remote-code-execution flaw to steal LLM provider keys and AWS credentials.
- The fix: upgrade to Langflow 1.9.2 or later, restrict access, and rotate model and cloud credentials.
The United States government now treats agent-building software as critical attack surface. CISA added CVE-2026-55255, an authorization bypass in the agent orchestration platform Langflow, to its Known Exploited Vulnerabilities catalog on July 7 with a July 10 remediation deadline for federal civilian agencies, as reported by The Hacker News. Trade coverage describes it as the first AI agent-building platform to land on the KEV list.
The chain
The flaw itself is modest on paper, an authorization bypass in Langflow's responses endpoint that lets an authenticated attacker execute another user's flow. In the wild it is not being used alone. Sysdig documented a late-June campaign chaining it with CVE-2026-33017, an unauthenticated remote-code-execution flaw, to harvest what actually matters: LLM provider API keys and AWS credentials. Sysdig's researchers put the motive plainly: "AI orchestration platforms are a trove of credentials in their own right, and this operator clearly knew it."
Why orchestration platforms are the target
An agent platform is, by design, a box holding the keys to everything the agents touch: model accounts, cloud credentials, database connections, third-party tools. Compromise the platform and you inherit the agent's entire reach. That is the same lesson GitLost taught from the prompt-injection side last week, arriving now from the plain-old-software-vulnerability side. The remediation guidance is ordinary: upgrade to 1.9.2 or later, restrict who can reach the platform, rotate every credential it held. The extraordinary part is the addressee. When the federal government sets a patch deadline for an agent-building tool, the agent stack has formally joined the list of infrastructure someone else plans to attack.