What is the CVSS score of CVE-2026-8183?

CVE-2026-8183 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow OSS are affected by CVE-2026-8183?

IBM Langflow OSS (versions 1.0.0-1.10.3) creates an insider threat vector by allowing any authenticated user to harvest system credentials and keys through path traversal attacks.. A patch is available.

How to fix or mitigate CVE-2026-8183?

Within 24 hours, inventory all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and assess whether each instance processes sensitive data, credentials, or configuration files. Within 7 days, apply the vendor-released patch referenced in IBM advisory node/7282647, upgrading all instances to the latest patched version across development, staging, and production environments. Within 30 days, verify successful patch deployment on all systems, analyze authentication logs from the vulnerable period for suspicious file-access patterns originating from low-privileged accounts, and deploy network segmentation or IP-based access controls to limit Langflow instance connectivity to authorized users only.

IBM Langflow OSS CVE-2026-8183

EUVD-2026-53554 HIGH

Path Traversal (CWE-22)

2026-08-05 ibm

GHSA-p865-qggm-g9qx

Path Traversal IBM Langflow Oss

7.7

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-exploitable path traversal requiring only a low-privileged account; scope change to host FS confirmed; no integrity or availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:47 vuln.today

CVE Published

Aug 05, 2026 - 18:23 cve.org

HIGH 7.7

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to v i ew arbitrary files on the system.

AnalysisAI

Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.3 enables authenticated remote attackers to read arbitrary files on the underlying system by submitting URLs containing dot-dot sequences (/../). The CVSS scope change metric (S:C) confirms that exploitation reaches beyond the application's own directory boundary, exposing system-level files such as credentials, configuration, or private keys to any low-privileged account holder. No public exploit code has been identified at time of analysis, though IBM has released a patch via advisory node/7282647.

Technical ContextAI

IBM Langflow OSS is IBM's enterprise distribution of the open-source Langflow AI/LLM workflow orchestration platform. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal class where user-supplied URL path segments containing '../' sequences are not properly sanitized or canonicalized before being used to construct file system paths. The affected CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* covers the full version range 1.0.0 through 1.10.3. The CVSS scope metric S:C indicates the traversal can escape the application's intended working directory into the broader host file system, reaching files the application process has OS-level read access to.

RemediationAI

Apply the vendor-released patch per IBM's security advisory at https://www.ibm.com/support/pages/node/7282647. The exact fixed version number is not specified in the available data - consult the advisory directly to confirm the target upgrade version before patching. As compensating controls where immediate patching is not possible: restrict the application's OS-level file system permissions so the process account can only read directories required for operation, reducing the blast radius of any traversal. Deploy the application inside a container or chroot jail with read-only mounts to limit accessible paths. Enable ingress request logging and alert on URL patterns containing repeated '../' or '%2e%2e' sequences to detect exploitation attempts. Limit Langflow account creation to trusted users only, as PR:L means any valid account is a potential attack surface.