CVE-2026-33053: Langflow Auth Bypass Vulnerability

CVE-2026-33053 Overview

CVE-2026-33053 is an Insecure Direct Object Reference (IDOR) vulnerability in Langflow, a popular tool for building and deploying AI-powered agents and workflows. The vulnerability exists in the delete_api_key_route() endpoint, which accepts an api_key_id path parameter and deletes the corresponding API key without verifying that the key belongs to the authenticated user making the request.

This authorization bypass flaw allows any authenticated user to delete API keys belonging to other users by manipulating the api_key_id parameter, potentially disrupting service access and causing denial of service conditions for affected users.

Critical Impact

Authenticated attackers can delete any user's API keys, causing service disruption and potential denial of service across the Langflow platform.

Affected Products

• Langflow versions prior to 1.9.0
• Langflow AI-powered agent and workflow deployments using vulnerable API key management

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33053 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-33053

Vulnerability Analysis

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The flaw stems from inadequate authorization checks in the API key deletion functionality.

The delete_api_key_route() endpoint implements a generic authentication check using the get_current_active_user dependency, which verifies that the requester is a valid, authenticated user. However, this check only confirms authentication status—it does not verify authorization. The subsequent delete_api_key() CRUD function fails to validate whether the specified api_key_id belongs to the currently authenticated user before performing the deletion operation.

This architectural oversight means that once a user is authenticated, they can supply any valid api_key_id to the endpoint and successfully delete that key, regardless of ownership. The attack requires network access and low-privilege authenticated access, but exploitation is straightforward once these prerequisites are met.

Root Cause

The root cause is a missing object-level authorization check in the delete_api_key() CRUD function. While the endpoint correctly enforces authentication (verifying "who you are"), it fails to enforce authorization (verifying "what you can do"). The CRUD function should validate that the api_key_id parameter references a resource owned by or accessible to the requesting user before executing the delete operation.

Attack Vector

The attack can be executed remotely over the network by any authenticated user. An attacker would:

1. Authenticate to the Langflow application with valid credentials
2. Enumerate or guess valid api_key_id values belonging to other users
3. Send DELETE requests to the delete_api_key_route() endpoint with target api_key_id values
4. Successfully delete API keys belonging to other users without proper authorization

The vulnerability allows manipulation of the integrity of other users' data and can cause availability impacts by removing API keys that are required for legitimate service access. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33053

Indicators of Compromise

• Unusual patterns of API key deletion requests from a single authenticated user
• Deletion of API keys followed by user complaints about lost access
• Multiple api_key_id values being deleted in rapid succession from the same session
• API logs showing deletion requests for keys not owned by the requesting user

Detection Strategies

• Implement logging that captures both the requesting user ID and the owner of the api_key_id being deleted
• Monitor for anomalous deletion patterns where users delete keys at rates exceeding normal behavior
• Audit authentication logs for users making requests to delete resources they don't own
• Deploy application-layer monitoring to detect IDOR attack patterns targeting API endpoints

Monitoring Recommendations

• Enable detailed access logging for all API key management endpoints
• Create alerts for API key deletion events where requester ID differs from key owner ID
• Monitor for enumeration patterns (sequential or predictable api_key_id access attempts)
• Review Langflow application logs regularly for unauthorized access attempts

How to Mitigate CVE-2026-33053

Immediate Actions Required

• Upgrade Langflow to version 1.9.0 or later immediately
• Audit API key deletion logs to identify any unauthorized deletions that may have occurred
• Regenerate API keys for users who may have been affected by exploitation
• Implement network-level access controls to limit API endpoint exposure while patching

Patch Information

The vulnerability has been addressed in Langflow version 1.9.0. Organizations should upgrade to this version or later to receive the security fix. The patch adds proper object-level authorization checks to ensure that users can only delete API keys they own.

For patch details and upgrade instructions, see the GitHub Security Advisory.

Workarounds

• Restrict network access to Langflow API endpoints using firewall rules or reverse proxy configuration
• Implement additional authentication layers (such as API gateway policies) that validate resource ownership
• Limit user account creation to reduce the potential attacker pool
• Monitor and alert on all API key deletion events until the patch can be applied

# Example: Restrict access to API endpoints using nginx
# Add to your Langflow nginx configuration
location /api/v1/api_key {
    # Restrict to trusted internal networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    proxy_pass http://langflow_backend;
}