What is the CVSS score of CVE-2026-7646?

CVE-2026-7646 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-7646?

Yes, a public proof-of-concept exploit is available for CVE-2026-7646. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-7646?

Yes, a patch is available for CVE-2026-7646. Update the affected software to the latest version immediately.

IBM Langflow OSS CVE-2026-7646

EUVD-2026-53464 MEDIUM

Path Traversal (CWE-22)

2026-08-05 ibm

GHSA-x37c-x545-wrmw

Path Traversal IBM Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

MCP endpoint is network-accessible and low-complexity; PR:L required as exploitation demands a valid authenticated session; confidentiality-only as no write or availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:21 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path traversal sequence in the filename.

AnalysisAI

Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP resources/read request using URL-encoded traversal sequences. Authenticated low-privilege users can read other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables - leaking the JWT secret effectively enables token forgery and full account takeover beyond what the CVSS 6.5 score implies. No public exploit identified at time of analysis; vendor patch is available per IBM advisory.

Technical ContextAI

IBM Langflow OSS is a visual, open-source framework for building AI/LLM workflows, built on top of the Model Context Protocol (MCP). The MCP resources/read endpoint is designed to provide AI agents structured access to server-side resources using a filename parameter. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the server fails to canonicalize or validate the filename parameter before resolving it on the filesystem, allowing URL-encoded sequences such as %2F..%2F..%2F to escape the intended document root. The CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* covers all versions 1.0.0 through 1.10.3. Notably sensitive targets reachable via traversal include the JWT signing secret (enabling token forgery), the SQLite database (all stored workflow and user data), and process environment variables (which may contain API keys, credentials, or cloud provider tokens).

RemediationAI

IBM has released a patch; upgrade IBM Langflow OSS to a version beyond 1.10.3 per the vendor advisory at https://www.ibm.com/support/pages/node/7282147 - the exact fixed version number is not specified in the available input data and should be confirmed directly from the advisory before upgrading. If immediate patching is not feasible, restrict external network access to the MCP resources/read API route via a reverse proxy or WAF rule, limiting it to known trusted clients only, noting this may disrupt legitimate MCP agent functionality. Additionally, rotate the JWT signing secret and any credentials or API keys present in process environment variables on any instance that has been accessible to untrusted authenticated users, as previously read secrets must be considered compromised. Audit access logs for anomalous resources/read requests containing %2F, .., or similar encoding patterns to assess potential prior exploitation.