CVE-2026-33053: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33053 is a Missing Ownership Verification (IDOR) vulnerability in Langflow's API key deletion endpoint that allows authenticated low-privileged users to delete API keys belonging to other users. It affects all Langflow versions prior to 1.9.0 (pip package). The vulnerability was discovered via Kolega.dev Deep Code Scan, published on March 16, 2026, and patched in version 1.9.0. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Langflow Advisory).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the delete_api_key_route() endpoint in src/backend/base/langflow/api/v1/api_key.py (lines 44–53) accepts an api_key_id UUID path parameter and performs only a generic authentication check via the get_current_active_user dependency, without verifying that the key belongs to the requesting user. The underlying delete_api_key() CRUD function in crud.py (lines 44–49) retrieves and deletes the key by ID alone, with no ownership check (api_key.user_id == current_user.id). By contrast, the GET and POST endpoints in the same file correctly filter by user_id, making this an inconsistent authorization implementation. An attacker needs only a valid authenticated session and a target API key UUID to exploit this (GitHub Advisory, Langflow Advisory).

A successful exploit allows an authenticated attacker to delete any other user's API keys, disrupting integrations and workflows that depend on those keys (high availability impact) and enabling unauthorized modification of another user's account state (high integrity impact). While direct data exfiltration is not the primary risk, the deletion of API keys can effectively lock users out of their integrations, constituting a denial-of-service against individual accounts. In multi-tenant or enterprise Langflow deployments, a malicious insider or compromised low-privilege account could systematically invalidate API keys across the entire user base (GitHub Advisory, Langflow Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.049% (18th percentile), indicating a currently low probability of exploitation in the near term. However, the practical exploitability is rated High by the discovering researchers, as the attack requires only a valid low-privilege account and UUID enumeration (Langflow Advisory).

1. Obtain a valid account: Register or obtain credentials for any low-privilege user account on the target Langflow instance (versions < 1.9.0).
2. Authenticate: Log in to the Langflow API to obtain a valid session token or bearer token via the authentication endpoint.
3. Enumerate API key UUIDs: Since API key IDs are UUIDs, an attacker may attempt to discover them through information leakage (e.g., API responses, logs, or shared dashboards), or by brute-forcing/enumerating UUID values if the search space is constrained.
4. Send DELETE request: Issue an HTTP DELETE request to the vulnerable endpoint with a target user's API key UUID: DELETE /api/v1/api_keys/{target_api_key_id} with the attacker's valid authentication header.
5. Confirm deletion: The server responds with {"detail": "API Key deleted"} regardless of key ownership, confirming unauthorized deletion of the target user's API key (GitHub Advisory, Langflow Advisory).

• Network: Repeated HTTP DELETE requests to /api/v1/api_keys/<uuid> from a single authenticated user account, especially targeting UUIDs not associated with that user's own keys; unusual volume of DELETE requests to the API key endpoint.
• Logs: Application access logs showing DELETE requests to the API key endpoint from a user account that does not own the targeted key IDs; HTTP 200 responses to DELETE requests for keys belonging to other users.
• Application Events: Sudden or unexpected invalidation of API keys for multiple users; users reporting their API keys stopped working without having deleted them themselves.
• Audit Trail: Absence of expected ownership-check failures (403 responses) in logs prior to patching, indicating the authorization check was never enforced.

Upgrade Langflow to version 1.9.0 or later, which includes the fix (commit fdc1b3b) that adds ownership verification to the delete_api_key function (GitHub Advisory, Langflow Advisory). No official configuration-based workaround is available for unpatched versions; organizations unable to upgrade immediately should restrict access to the Langflow API to trusted users only and monitor API key deletion events. After patching, conduct an audit of recent API key deletion logs to identify any unauthorized deletions that may have occurred.

The vulnerability was reported by Kolega.dev via their Deep Code Scan tool and credited to researchers FaizanKolega, kolega-ai-dev, and andifilhohub (GitHub Advisory). Coverage was picked up by security aggregators including RedPacket Security and The Hacker Wire shortly after disclosure. No significant vendor statements beyond the GitHub advisory or notable independent researcher commentary have been identified.