VULNERABILITY INTELLIGENCE

CVE-2026-33053

CVSS score8.8 HIGH

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-03-20

Last modified2026-06-17

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.