CVE-2026-33053 — Langflow has Missing Ownership Verification in API Key Deletion (IDOR)
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path paramet…
Published: 2026-03-20 · CVSS: 6.1 · CVSS 4.0
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7