What is the CVSS score of CVE-2026-7658?

CVE-2026-7658 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-7658?

Yes, a patch is available for CVE-2026-7658. Update the affected software to the latest version immediately.

IBM Langflow OSS CVE-2026-7658

EUVD-2026-53553 MEDIUM

Path Traversal (CWE-22)

2026-08-05 ibm

GHSA-59wg-6v2q-cr6p

IBM Path Traversal Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.1 HIGH

JWT signing key deletion causes platform-wide session invalidation and arbitrary directory deletion constitutes availability impact, warranting A:H over the vendor's A:N; all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:49 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.

AnalysisAI

Path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege network attackers to inject directory traversal sequences into the username field, bypassing containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JWT signing keys - the last of which forces platform-wide session invalidation for all users. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain low-privilege Langflow account

Delivery

Craft path-traversal username payload

Exploit

Submit to vulnerable username field

Install

Application constructs unsanitized filesystem path

Bypass containment directory boundary

Execute

Delete JWT signing keys or cross-tenant directories

Impact

Trigger platform-wide session invalidation or data destruction

Recon

Obtain low-privilege Langflow account

Delivery

Craft path-traversal username payload

Exploit

Submit to vulnerable username field

Install

Application constructs unsanitized filesystem path

Bypass containment directory boundary

Execute

Delete JWT signing keys or cross-tenant directories

Impact

Trigger platform-wide session invalidation or data destruction

Vulnerability AssessmentAI

Exploitation	Requires a valid low-privilege user account on the IBM Langflow OSS instance, as confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) scores this as 6.5 Medium, requiring only a low-privilege account and no user interaction over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a valid low-privilege Langflow account submits a crafted username such as '../../jwt_keys/' during an operation that triggers a path-dependent filesystem action - for example, account management or a workflow step that references the username as a directory component. The application constructs the path without sanitization, bypassing containment, and executes a deletion operation on the JWT signing key directory. …
Remediation	Apply the vendor-released patch per IBM advisory at https://www.ibm.com/support/pages/node/7282647. … Detailed patch versions, workarounds, and compensating controls in full report.