6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33053

CVE-2026-33053: Langflow has Missing Ownership Verification in API Key Deletion (IDOR)

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33053

CVE-2026-33053:

6.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langflow	pip	< 1.7.2	1.7.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the API key deletion mechanism of Langflow. The root cause is the delete_api_key function in src/backend/base/langflow/services/database/models/api_key/crud.py, which deleted API keys based solely on their ID (api_key_id) without verifying that the key belonged to the user making the request.

This vulnerability was exposed through the delete_api_key_route API endpoint in src/backend/base/langflow/api/v1/api_key.py. Although this endpoint required user authentication, it did not use the authenticated user's identity to authorize the deletion. It simply passed the api_key_id to the insecure delete_api_key function.

As a result, any authenticated user could send a DELETE request to the /api/v1/api_key/{api_key_id} endpoint with a valid API key ID belonging to any other user, and the system would delete it.

The patch addresses this by:

Modifying the delete_api_key function to accept a user_id and adding a check to ensure api_key.user_id matches the provided user_id before deletion.
Updating the delete_api_key_route endpoint to retrieve the current_user and pass current_user.id to the delete_api_key function, thereby correctly enforcing ownership.
Updating another call site in langflow.__main__.py within the aapi_key function to also pass the user ID.

The identified vulnerable functions are delete_api_key (the core of the vulnerability) and delete_api_key_route (the exposed API endpoint that triggers it). aapi_key is also included as it was another call site for the vulnerable function. During an exploit, a profiler would likely show delete_api_key_route being called, which in turn calls delete_api_key.

Vulnerable functions

delete_api_key

src/backend/base/langflow/services/database/models/api_key/crud.py

This function is responsible for deleting an API key from the database. The original implementation only required the `api_key_id` and did not perform any check to ensure that the user requesting the deletion was the owner of the API key. This allowed any authenticated user to delete any other user's API key by guessing its ID.

delete_api_key_route

src/backend/base/langflow/api/v1/api_key.py

This is the API endpoint that exposes the vulnerable functionality. It receives the `api_key_id` from the request path and calls the `delete_api_key` function. The original implementation authenticated the user but did not pass the current user's information to the `delete_api_key` function, thus failing to enforce ownership on the key being deleted.

aapi_key

src/backend/base/langflow/__main__.py

This function calls the vulnerable `delete_api_key` function without providing the user ID for authorization. While the context suggests it might be used by a superuser, it still represents a call to the insecure function. The core vulnerability lies in `delete_api_key`'s implementation, and this function is a consumer of it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.