What is the CVSS score of CVE-2026-7872?

CVE-2026-7872 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow are affected by CVE-2026-7872?

IBM Langflow Open Source versions 1.0.0-1.10.0 allow authenticated users to extract critical signing keys and forge administrator tokens, enabling full application compromise.. A patch is available.

How to fix or mitigate CVE-2026-7872?

Within 24 hours, inventory all systems running IBM Langflow Open Source versions 1.0.0 through 1.10.0 using your asset management and deployment records. Within 7 days, apply the vendor-released patch to all affected instances following IBM's advisory guidance. Within 30 days, audit authentication logs and JWT token activity for unauthorized access patterns, verify that no administrator accounts were compromised during the vulnerability window, and confirm all systems are running the patched version.

IBM Langflow CVE-2026-7872

EUVD-2026-45282 HIGH

Path Traversal (CWE-22)

2026-07-17 ibm

GHSA-c975-75gc-hhvw

Path Traversal IBM Langflow Oss

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable endpoint (AV:N/AC:L) but requires a prior low-privilege authenticated account (PR:L); arbitrary read plus token forgery yields C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 18:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 18:07 NVD

7.5 (HIGH) 8.1 (HIGH)

Analysis Generated

Jul 17, 2026 - 19:48 vuln.today

CVE Published

Jul 17, 2026 - 19:15 cve.org

HIGH 7.5

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

AnalysisAI

Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated attacker traverse the filesystem to exfiltrate sensitive files - most critically the JWT signing key - and then forge valid authentication tokens to impersonate any user, including administrators. The path-traversal-to-account-takeover chain turns a low-privilege foothold into full application compromise. No public exploit identified at time of analysis, and the EPSS score is low (0.38%, 31st percentile), but a vendor patch is available and the impact is severe.

Technical ContextAI

Langflow is an open-source, Python-based visual framework for building LLM and agent workflows, exposing a web/API backend that authenticates users with JWT (JSON Web Token) bearer tokens signed by a server-side secret key. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): a file-handling endpoint fails to properly canonicalize or restrict user-supplied paths, so sequences such as '../' escape the intended directory and reach arbitrary files on the host. Because JWTs rely on the secrecy of the signing key for integrity, reading that key collapses the entire authentication model - the attacker can mint tokens with arbitrary 'sub'/role claims that the server accepts as genuine. Affected component per CPE is cpe:2.3:a:ibm:langflow_oss across all listed versions.

RemediationAI

Patch available per vendor advisory - upgrade IBM Langflow OSS to the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7278934 (no exact fixed version number is stated in the provided data, so consult that advisory for the precise patched build rather than assuming one). After patching, rotate the JWT signing key and invalidate all existing sessions/tokens, since any prior arbitrary-read exposure means an attacker could already possess the old key and forge tokens even against a patched server; also rotate any other secrets readable from the host. As compensating controls until patching, restrict network access to the Langflow interface to trusted operators only (place it behind a VPN or IP allowlist rather than exposing it to the internet), tighten who can obtain authenticated accounts since PR:L is the exploitation gate, and run the Langflow process under a least-privilege OS account so traversal reaches as few sensitive files as possible - with the trade-off that these controls limit reach but do not close the underlying traversal flaw. Monitor request logs for path-traversal patterns ('../', encoded traversal sequences) against file-handling endpoints.