CVE-2026-33053
HIGH
langflow
NVD
CVSS Score
8.8
Severity
HIGH
Published
Mar 20, 2026
Vendor
langflow
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.