Banked: 2026-07-14, cycle305 (Langflow CVE-2026-55255 incomplete-fix drill = FIX-COMPLETE-SAFE / WALK).
Before hunting sibling endpoints for an incomplete-fix, read WHERE the fix was applied:
- Fix INSIDE the shared helper / choke point (e.g. PR #12832 added the user_id ownership check inside get_flow_by_id_or_endpoint_name itself, both UUID + endpoint_name branches) -> ALL callers are protected in one shot -> the "sibling-of-this-helper" hypothesis is DEAD -> set-difference yields nothing -> WALK fast. This is the GOOD outcome for the maintainer.
- Fix at ONE call site / endpoint handler (point fix) -> other callers of the same unguarded helper survive -> siblings live. This is where incomplete-fix findings live (cycle299 Amazon Q, cycle300/301, cycle240).
So: the FIRST question of any incomplete-fix drill = "is this fix central (helper/middleware) or per-site (one handler)?" It predicts the whole outcome cheaply, before any clone. Read the PR diff's changed-file + function BEFORE enumerating siblings.
Langflow maintainers are SWEEPERS on flow-access IDOR, not point-fixers:
- CVE-2026-55255 (/api/v1/responses helper) = fixed CENTRALLY in the helper (PR #12832, v1.9.1).
- CVE-2026-33760 (GHSA-9c59-2mvc-vfr8) = Monitor API 7-endpoint IDOR, swept together, fixed v1.9.0.
- CVE-2026-33017 = public-flow unauth hardening.
- Post-fix they added widen_for_shares (default owner-scoped) + explicit security comments across chat.py/voice_mode.py/helpers/flow.py.
=> Langflow's flow-access neighborhood is comprehensively swept by the maintainers themselves = SATURATED for cross-tenant IDOR. Deprioritize (per the sweeper-vs-point-fixer predictor, cycle248). Actively-exploited + maintainer-swept = double reason to walk.
The one un-owner-scoped survivor: voice_mode.py:499 get_flow_desc_from_db (via /api/v1/voice/ws/flow_as_tool/{flow_id}) leaks another user's flow.description STRING to any authed user - but flow EXECUTION is owner-gated downstream (_read_flow -> authorized_or_owner_scoped). Low (single non-secret field, no exec, no secrets). Fails the 7-gate severity/materiality floor -> NOT a candidate. Honest downgrade; optional hardening-note only.
This was the right pivot AWAY from the over-mined AI-agent symlink vein + it answered a queued operator question with a definitive result. A clean WALK that banks a reusable predictor > a forced marginal finding.