{"action":"Upgrade langflow to 1.9.0 or later.","affected":[{"fixed":"1.9.0","introduced":"0"}],"component":"langflow","cve_ids":["CVE-2026-33053"],"ecosystem":"PyPI","epss":0.00544,"exploited":false,"fixed_versions":["1.9.0"],"ghsa_id":"GHSA-rf6x-r45m-xv3w","id":"tcs_01M5KHDG90KMQECMQB6DKAJB5V","modified_at":"2026-05-20T09:19:04.454769Z","published_at":"2026-03-20T07:16:13.160Z","references":["https://osv.dev/vulnerability/PYSEC-2026-78","https://github.com/langflow-ai/langflow/security/advisories/GHSA-rf6x-r45m-xv3w"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-78","url":"https://osv.dev/vulnerability/PYSEC-2026-78"}],"summary":"Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with"}