Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-33760Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in langflow from langflow-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 57.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	langflow	1.9.0	GHSA-9c59-2mvc-vfr8
PyPI	langflow	1.9.0	PYSEC-2026-242

Affected products (as reported)

Vendor	Product	Versions
langflow-ai	langflow	< 1.9.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-9c59-2mvc-vfr8 x_refsource_CONFIRM