CVE-2026-33053 PUBLISHED

Langflow has Missing Ownership Verification in API Key Deletion (IDOR)

Assigner: GitHub_M
Reserved: 17.03.2026 Published: 20.03.2026 Updated: 20.03.2026

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L
CVSS Score: 6.1

Product Status

Vendor langflow-ai
Product langflow
Versions
  • Version < 1.9.0 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE