What is the CVSS score of EUVD-2026-53553?

EUVD-2026-53553 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-53553?

Yes, a patch is available for EUVD-2026-53553. Update the affected software to the latest version immediately.

IBM Langflow OSS EUVD-2026-53553

| CVE-2026-7658 MEDIUM

Path Traversal (CWE-22)

2026-08-05 ibm

GHSA-59wg-6v2q-cr6p

Path Traversal IBM Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.1 HIGH

JWT signing key deletion causes platform-wide session invalidation and arbitrary directory deletion constitutes availability impact, warranting A:H over the vendor's A:N; all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:49 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.

AnalysisAI

Path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege network attackers to inject directory traversal sequences into the username field, bypassing containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JWT signing keys - the last of which forces platform-wide session invalidation for all users. No public exploit or CISA KEV listing has been identified at time of analysis, though the operational impact in multi-tenant deployments is severe despite the moderate CVSS score of 6.5.

Technical ContextAI

CWE-22 (Path Traversal) describes a failure to neutralize special path elements ('../', '..//', encoded variants) before using attacker-controlled input in filesystem operations. IBM Langflow OSS is the open-source AI workflow orchestration platform maintained by IBM, identified by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*. The vulnerability arises because the application uses the username value - supplied during account operations or workflow execution - as a component of filesystem path construction without stripping or validating traversal sequences. This allows the attacker to escape the intended user-scoped directory boundary, reach arbitrary filesystem locations, and trigger destructive operations. The JWT signing key deletion vector is particularly impactful: removing the key used to sign session tokens immediately invalidates every active session on the platform.

RemediationAI

Apply the vendor-released patch per IBM advisory at https://www.ibm.com/support/pages/node/7282647. The exact patched version number is not specified in currently available data and should be confirmed directly from the IBM advisory before deployment. As an interim compensating control, enforce strict input validation at the application gateway or WAF layer to reject usernames containing path traversal sequences such as '../', '%2e%2e%2f', and URL-encoded variants - note that WAF rules may have false positive risk and should be tested against legitimate usernames. Additionally, restrict the filesystem permissions of the Langflow service account to the minimum required directories, limiting the blast radius of any traversal attempt. For multi-tenant environments, auditing filesystem ownership and isolating tenant directories with OS-level permission boundaries provides an additional containment layer.