CVE-2026-33053 — Langflow has Missing Ownership Verification in API Key Deletion (IDOR)

CVE-2026-33053

Langflow has Missing Ownership Verification in API Key Deletion (IDOR) PUBLISHED

Description (CNA)

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

Affected (CNA)

Vendor / product	Versions
langflow-ai / langflow	affected < 1.9.0

CWE

CWE-639

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-rf6x-r45m-xv3w

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.