CVE-2026-55423

Langflow: Logout button does not clear session

State: Published
Severity: 6.1 Medium
Published: Jun 23, 2026
Updated: Jun 23, 2026
Reserved: Jun 16, 2026

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
langflowlangflow-ai	< 1.7.0Affected

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276
https://github.com/langflow-ai/langflow/pull/10527
https://github.com/langflow-ai/langflow/pull/10528

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.