CVE-2026-33053

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

PUBLISHED Reserved 2026-03-17 | Published 2026-03-20 | Updated 2026-03-20 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

References

github.com/...ngflow/security/advisories/GHSA-rf6x-r45m-xv3w

cve.org (CVE-2026-33053)

nvd.nist.gov (CVE-2026-33053)

Download JSON