Langflow API Key Deletion Vulnerability Allows Unauthorized Key Removal

A vulnerability exists in Langflow versions prior to 1.9.0 in the delete_api_key_route() endpoint, which allows authenticated users to delete API keys belonging to other users. The endpoint accepts an api_key_id parameter and performs deletion with only a basic authentication check, without verifying ownership of the API key. This flaw enables an authenticated attacker to guess or discover API key IDs and delete them, potentially leading to account takeover and disruption of integrations.

Impact

Exploitation of this vulnerability allows an authenticated user to delete API keys of other users, leading to account takeover and disruption of services that rely on those API keys.

Remediation

Users are advised to update Langflow to version 1.9.0 or later, where this vulnerability has been patched.