CVE-2026-33053: Langflow

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.

Affected products

• Langflow Langflow: before 1.9.0 (fixed in 1.9.0)

Published 2026-03-20. Last modified 2026-06-17.