CVE-2026-33760

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, modify, rename, or permanently delete another user's data by supplying the target's resource ID or flow_id. This is a classic IDOR/BOLA vulnerability. Notably, the same source file (monitor.py) contains one correctly-implemented endpoint that uses an ownership check, demonstrating the correct pattern was known but inconsistently applied. This vulnerability is fixed in 1.9.0.

• CWE-639

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-9c59-2mvc-vfr8Exploit, Vendor Advisory

Published

Jun 23, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33755Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-33756Saleor is an e-commerce platform. From 2.0.0 to before 3.23.…7.5
• CVE-2026-33757OpenBao is an open source identity-based secrets management …8.3
• CVE-2026-33758OpenBao is an open source identity-based secrets management …6.1
• CVE-2026-33759WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-3376A security vulnerability has been detected in Tenda F453 1.0…8.8
• CVE-2026-33761WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33762go-git is an extensible git implementation library written i…2.8
• CVE-2026-33763WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33764WWBN AVideo is an open source video platform. In versions up…4.3
• CVE-2026-33765Pi-hole Admin Interface is a web interface for managing Pi-h…9.8
• CVE-2026-33766WWBN AVideo is an open source video platform. In versions up…6.5