OTX Threat: Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited

On June 25, 2026, the first active exploitation of CVE-2026-55255, a critical CVSS 9.9 Langflow vulnerability, was documented. Langflow is an open-source framework for building AI agents and RAG pipelines. A single operator exploited both CVE-2026-55255 (cross-tenant IDOR) and CVE-2026-33017 (unauthenticated RCE, CVSS 9.3) against the same instance. Despite its lower score, the RCE has been exploi CVEs: CVE-2026-33017, CVE-2026-55255 Sectors: Technology