CVE-2026-33053: Langflow API Key Deletion Lacks Ownership Verification (IDOR)
Summary
CVE-2026-33053: Langflow is Missing Ownership Verification in API Key Deletion (IDOR). Affects langflow versions < 1.7.2. Fixed in 1.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langflow is an open-source framework designed for building and managing language models and their integrations. It provides functionalities for creating, deleting, and managing API keys that allow users to interact with the language models securely. However, due to a flaw in its API key deletion process, Langflow is vulnerable to an Insecure Direct Object Reference (IDOR) attack, allowing unauthorized users to delete API keys belonging to others.
Vulnerability Detail
The vulnerability arises from the delete_api_key_route() endpoint, which accepts an api_key_id parameter and deletes the corresponding API key without verifying if the key belongs to the authenticated user. This oversight allows an attacker to enumerate and delete API keys of other users by guessing their IDs. The lack of ownership verification can lead to account takeover, denial of service, and disruption of services for other users. The affected code fails to pass the current user to the delete function, which is critical for ensuring that only the owner can delete their API keys.
How To Fix
Latest published version: 1.14.0.dev2 as of 22 Oct 2026
pip install --upgrade "langflow==1.14.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.2
This is the first release that contains the fix.
pip install --upgrade "langflow==1.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit access to the delete_api_key_route endpoint to trusted users only, or implement additional logging to monitor deletion requests until a proper fix can be applied.
Conclusion
The CVE-2026-33053 vulnerability in Langflow poses significant risks due to the lack of ownership verification in API key deletion. It is crucial for users to update to the patched version and implement the recommended fixes to secure their applications against potential attacks.
See every vulnerability recorded for langflow →
FAQ
CVE-2026-33053 is a vulnerability in Langflow that allows authenticated users to delete API keys belonging to other users due to a lack of ownership verification.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to account takeover, denial of service, and disruption of services for other users by allowing unauthorized deletion of API keys.
Update Langflow to version 1.7.2 or later and modify the delete_api_key_route and delete_api_key functions to include ownership verification.
Vulert is a monitoring tool that uses Pipfile.lock to track and alert in real-time for open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
