Description
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| langflow-ai | langflow | < 1.9.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | langflow | < 1.9.0 | 1.9.0 | GHSA-rf6x-r45m-xv3w |
Advisories 1
- WID-SEC-2026-0747 Langflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 19, 2026