CVE-2026-33760: Langflow IDOR/BOLA in Monitor API

# CVE-2026-33760: Langflow IDOR/BOLA in Monitor API

https://gcdradar.vercel.app/incidents/cve-2026-33760-langflow-idor-bola-in-monitor-api · AIR-2026-0753 · closed 2026-06-16

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-06-16
- AI role: Attack on AI
- Products: Langflow
- CVE ids: CVE-2026-33760
- CVSS: 8.8

## Summary

Langflow's monitor router exposed endpoints that failed to verify resource ownership, permitting authenticated users to access or delete other users' data. Users are advised to update to secure versions.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-23: CVE-2026-33760: Langflow is a tool for building and deploying AI-powered agents and workflows. (https://nvd.nist.gov/vuln/detail/CVE-2026-33760)
- 2026-06-16: CVE-2026-33760: Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints  (https://github.com/advisories/GHSA-9c59-2mvc-vfr8)

## Sources

- 2026-06-16 GitHub Advisory Database: CVE-2026-33760: Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints  https://github.com/advisories/GHSA-9c59-2mvc-vfr8
- 2026-06-23 NVD: CVE-2026-33760: Langflow is a tool for building and deploying AI-powered agents and workflows. https://nvd.nist.gov/vuln/detail/CVE-2026-33760

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.