A critical authorization bypass vulnerability in Langflow allows authenticated attackers to delete arbitrary API keys, leading to potential service disruption and loss of access control.

The application fails to perform proper ownership validation within the delete_api_key_route endpoint, allowing any authenticated user to trigger the deletion of API keys owned by other users.

The vulnerability carries a CVSS score of 8.8, indicating a high potential for operational disruption. Successful exploitation allows an attacker to invalidate the API credentials of other users or administrators, resulting in unauthorized service downtime and a significant compromise of the application workflow integrity.

Immediate Action: Update the Langflow package to version 1.9.0 or later immediately to incorporate the required ownership checks.

Proactive Monitoring: Review application access logs for unusual patterns of API key deletion requests, particularly those originating from non-administrative user accounts.

Compensating Controls: Implement strict API gateway controls or network-level access restrictions to limit the exposure of the management endpoints to authorized personnel only.

Public Exploit Available: Unknown

Given the high CVSS severity and the ease of exploitation once an attacker has authenticated access, organizations should prioritize upgrading their Langflow environment to version 1.9.0. Failing to patch this vulnerability leaves the platform exposed to unauthorized administrative actions that could result in widespread service failure.