CVE-2026-33760: Langflow BOLA Vulnerability Allows Cross-User Data Access

Technical summary

The /api/v1/monitor router in Langflow prior to 1.9.0 exposes seven endpoints for querying and manipulating user resources (messages, sessions, build artifacts, LLM transaction logs) without server-side verification that the authenticated caller owns the targeted resource. An authenticated attacker can craft requests with arbitrary resource IDs or flow_ids to perform CRUD operations on any other user's data. The vulnerability is rooted in insufficient access control at the application layer—authentication is present (PR:L in the CVSS vector), but authorization checks are absent. Notably, the same monitor.py module contains a correctly-implemented endpoint with proper ownership validation, indicating the development team understood the pattern but failed to apply it uniformly across all seven endpoints. This inconsistency suggests a code review or testing gap rather than architectural ignorance.

Business impact

Organizations deploying Langflow face a severe multi-faceted risk. Users' AI workflows, conversation histories, and LLM interaction logs can be inspected by colleagues or attackers with valid accounts, exposing sensitive business logic, proprietary prompts, and potentially customer data. Adversaries can rename or corrupt workflow artifacts, disrupting legitimate operations and eroding trust in the platform. Permanent deletion of another user's sessions or build history could cause data loss and operational chaos. For enterprises using Langflow to prototype or run production AI agents, this vulnerability may trigger regulatory concerns (GDPR, HIPAA, SOC 2) if customer or personal data flows through these workflows. Reputational and compliance risk escalates if the flaw is exploited before patching.

Affected systems

Langflow versions prior to 1.9.0 are vulnerable. Any deployment of Langflow in a multi-user environment is at risk. The vulnerability requires valid authentication, so it does not affect single-user or isolated test deployments without user management. Organizations running Langflow on-premise, in containers, or via managed services should check their deployment version immediately. The vulnerability spans all seven affected endpoints in the monitor API, meaning all resource types exposed by that router are at risk from the same authorization flaw.

Exploitability

Exploiting this vulnerability is straightforward for any authenticated user. An attacker needs only valid credentials to Langflow (obtained through account creation, phishing, or insider threat) and knowledge of another user's resource ID or flow_id. Resource IDs may be discoverable through enumeration, error messages, or simple sequential guessing, depending on the ID scheme. No special privileges, network access beyond normal API endpoints, or complex interactions are required. The CVSS score of 8.8 reflects the low complexity (AC:L), low privilege requirement (PR:L, authenticated access only), and complete impact on confidentiality, integrity, and availability of targeted resources. The vulnerability is likely in active use by threat actors if Langflow is deployed in environments where multiple users or untrusted accounts can be created.

Remediation

Update Langflow to version 1.9.0 or later immediately. This release patches the authorization checks across all seven affected monitor endpoints. After patching, validate the fix in a staging environment by attempting cross-user resource access with test accounts and confirming that access is denied. Review access logs and audit trails to identify whether this vulnerability was exploited prior to patching—look for unusual cross-user API activity, deletion or modification of resources by unexpected users, or access patterns that suggest enumeration of resource IDs. If compromise is suspected, reset user passwords, review workflow modifications for tampering, and audit any exported data or LLM logs.

Patch guidance

Langflow 1.9.0 introduces proper ownership validation on all seven vulnerable endpoints in the /api/v1/monitor router. Deploy this version to all Langflow instances in your environment. If you are running Langflow in a containerized environment, pull the updated image tag corresponding to 1.9.0. If running from source, update to the matching tag and rebuild. Test the patch in a non-production environment first to verify compatibility with any custom integrations or extensions. Verify against the vendor advisory and release notes to confirm all monitor endpoints have been patched and that no other vulnerabilities were introduced in this release.

Detection guidance

Monitor API access logs for the /api/v1/monitor endpoints, particularly for DELETE and PUT/PATCH requests. Alert on authenticated users accessing resource IDs that do not match their own user identifier or session ownership. Implement audit logging of resource modifications and deletions with full context (who, what, when). Check for rapid enumeration of resource IDs by a single user across multiple sequential or random IDs. Review Langflow audit logs (if available) for cross-user resource access patterns. If vulnerability scanning is performed, confirm that pre-1.9.0 instances are flagged as high-risk. Post-patch, periodically retest to ensure the authorization checks remain in place and are not bypassed by API parameter manipulation (e.g., path traversal, case sensitivity variations).

Why prioritize this

This vulnerability merits immediate patching due to the combination of high CVSS score (8.8), complete loss of confidentiality and integrity for user data, low exploitation complexity, and the multi-user nature of most Langflow deployments. The vulnerability has existed across multiple prior releases, increasing the likelihood of prior exploitation. Unlike remote code execution flaws, BOLA vulnerabilities may go undetected for extended periods because they do not cause obvious system failures. If your organization uses Langflow in a shared environment (team, multi-tenant, or open-registration), prioritize this patch within days, not weeks. The fact that the correct pattern is demonstrated in the same codebase suggests this is not a complex architectural issue to fix, reducing risk of regression in 1.9.0.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects: (1) network-accessible attack vector (AV:N) via standard HTTPS API; (2) low attack complexity (AC:L)—no special conditions or engineering required; (3) low privilege requirement (PR:L)—any authenticated user qualifies; (4) no user interaction (UI:N); (5) unchanged scope (S:U)—impact is confined to Langflow resources, not adjacent systems; and (6) high impact across all three security dimensions: confidentiality (C:H, full read access to others' data), integrity (I:H, ability to modify or delete), and availability (A:H, permanent deletion capability). The primary mitigating factor is the authentication requirement; unauthenticated attackers cannot exploit this flaw. Organizations without multi-user Langflow deployments face lower risk, but this scenario is uncommon in production environments.

Frequently asked questions