Executive Summary

CVE-2026-33053 is an Insecure Direct Object Reference (IDOR) vulnerability in the langflow-ai/langflow project. The vulnerability occurs because the delete_api_key() function deletes API keys without verifying that the key belongs to the currently authenticated user.

Specifically, the delete_api_key_route endpoint accepts an api_key_id parameter and calls delete_api_key() without checking ownership. This means an authenticated attacker can delete API keys of other users by guessing or enumerating their API key IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to delete API keys belonging to other users. The impacts include:

• Account takeover by disrupting legitimate API key access.
• Denial of service by deleting keys and preventing legitimate API usage.
• Disruption of integrations relying on those API keys.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the deletion of API keys without verifying ownership, which can be detected by monitoring API requests to the delete_api_key_route endpoint for suspicious activity.

Specifically, detection can focus on identifying requests where an authenticated user attempts to delete API keys that do not belong to them.

Since the vulnerability allows an attacker to enumerate or guess API key UUIDs, commands or scripts that attempt to delete API keys by iterating over possible UUIDs could indicate exploitation attempts.

However, no specific detection commands or tools are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The immediate mitigation step is to modify the delete_api_key_route endpoint and the delete_api_key() function to verify that the API key being deleted belongs to the current authenticated user.'}, {'type': 'paragraph', 'content': 'This involves passing the current_user parameter to the delete_api_key() function and checking ownership before deletion.'}, {'type': 'list_item', 'content': 'If the API key does not belong to the current user, the system should raise a 403 Forbidden HTTP error to prevent unauthorized deletion.'}, {'type': 'list_item', 'content': "Example fix code snippet: if api_key.user_id != user_id: raise HTTPException(status_code=403, detail='Unauthorized')"}, {'type': 'paragraph', 'content': 'This fix ensures that only the owner of an API key can delete it, preventing account takeover, denial of service, and disruption of integrations.'}] [1]

Useful 0 Not Useful 0