Langflow: IDOR/BOLA in Monitor API, Missing Ownership Enforcement on 7 Endpoints
Langflow
More for Langflow RSS feed for Langflow
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-33760
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 26, 2026
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0.
Description quoted from the NVD record.
Who is affected
Langflow is a tool for building and running apps, AI agents and automated workflows that use AI language models. This flaw affects all versions before 1.9.0. It is in the monitoring part of the product, which handles messages, sessions, build results and logs of activity with AI models. That part does not check whether the signed-in person actually owns the data they ask for. As a result, anyone with a login to your Langflow could read, change, rename or permanently delete another user's data by supplying that data's ID. This flaw is rated High.
What to do
- If someone in your organization installed or runs Langflow, ask that person to check which version is in use.
- If the version is older than
1.9.0, have them update Langflow to1.9.0or later, which fixes this flaw. - If an IT provider or vendor runs Langflow for your organization, send them this advisory and ask when the update to
1.9.0will be done. - For more detail on the update, check the vendor advisory linked on this page.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.