CVE-2026-33053
published 2026-03-20CVE-2026-33053: Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an…
PriorityP359high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.39%
30.8th percentile
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| langflow-ai | langflow | < 1.9.0 | 1.9.0 |
| langflow | langflow | < 1.9.0 | 1.9.0 |
| langflow | langflow | >= 0 < 1.7.2 | 1.7.2 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
osv·2026-03-18
CVE-2026-33053 [HIGH] Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
**Detection Method:** Kolega.dev Deep Code Scan
| Attribute | Value |
|---|---|
| Location | src/backend/base/langflow/api/v1/api_key.py:44-53 |
| Practical Exploitability | High |
| Developer Approver | [email protected] |
### Description
The delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.
### Affected Code
```
@router.delete("/{api_key_id}", dependencies=[Depends(auth_utils.get_current_active_user)])
async def delete_api_key_route(
api_key_id: UUID,
db: DbSession,
):
try:
await delet
GHSA
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
ghsa·2026-03-18
CVE-2026-33053 [HIGH] CWE-639 Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
Langflow is Missing Ownership Verification in API Key Deletion (IDOR)
**Detection Method:** Kolega.dev Deep Code Scan
| Attribute | Value |
|---|---|
| Location | src/backend/base/langflow/api/v1/api_key.py:44-53 |
| Practical Exploitability | High |
| Developer Approver | [email protected] |
### Description
The delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.
### Affected Code
```
@router.delete("/{api_key_id}", dependencies=[Depends(auth_utils.get_current_active_user)])
async def delete_api_key_route(
api_key_id: UUID,
db: DbSession,
):
try:
await delet
No detection rules found.
No public exploits indexed.
2026-03-20
Published