EUVD-2026-71260
GHSA-hh38-vgr5-vvww
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
PR:L for authenticated-only exploitation; S:C reflects secrets crossing trust boundary to external LLM endpoints; no integrity or availability impact confirmed.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem - including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) - by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.
AnalysisAI
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to read arbitrary files from the server filesystem - including JWT signing keys, the application secret_key, the runtime database, /proc/self/environ, and other tenants' uploaded files - by supplying absolute paths or traversal sequences in the files parameter of a build request. What elevates the risk beyond a standard directory traversal is the exfiltration mechanism: file contents are embedded directly into the LLM prompt and transmitted to the configured model endpoint, meaning secrets leave the controlled environment and reach third-party AI provider infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the Langflow instance - any registered user with PR:L privileges, not just administrators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) accurately reflects the risk profile: network-accessible, low complexity, requiring only a valid authenticated session with no elevated privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade IBM Langflow OSS to the patched version identified in the IBM advisory at https://www.ibm.com/support/pages/node/7285641; the exact fixed version number is not specified in currently available data and must be confirmed directly from that advisory page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployed IBM Langflow instances to identify versions 1.0.0 through 1.11.2 and their configured LLM provider endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today