CVE-2026-55423: Langflow logout button fails to clear session tokens

# CVE-2026-55423: Langflow logout button fails to clear session tokens

https://gcdradar.vercel.app/incidents/cve-2026-55423-langflow-logout-button-fails-to-clear-session · AIR-2026-0022 · closed 2026-06-19

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-06-19
- AI role: Attack on AI
- Products: Langflow
- CVE ids: CVE-2026-55423
- CVSS: 6.1

## Summary

Langflow logout endpoints and frontend fail to properly clear authentication tokens and cookies due to mismatched parameters. Previous users remain logged in unless another user explicitly authenticates.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-23: CVE-2026-55423: Langflow is a tool for building and deploying AI-powered agents and workflows. (https://nvd.nist.gov/vuln/detail/CVE-2026-55423)
- 2026-06-19: CVE-2026-55423: Langflow: Logout button does not clear session (https://github.com/advisories/GHSA-7hw8-6q6r-4276)

## Sources

- 2026-06-19 GitHub Advisory Database: CVE-2026-55423: Langflow: Logout button does not clear session https://github.com/advisories/GHSA-7hw8-6q6r-4276
- 2026-06-23 NVD: CVE-2026-55423: Langflow is a tool for building and deploying AI-powered agents and workflows. https://nvd.nist.gov/vuln/detail/CVE-2026-55423

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.