AI Threat AlertCVE-2026-103360: Langflow: path traversal exposes sensitive files
MEDIUMIBM Langflow OSS 1.0.0 through 1.12.2 has a path traversal flaw (CWE-22) that lets any authenticated user read files outside the directories they should be able to reach, and the 8.1 CVSS score (high confidentiality and integrity impact) reflects how easily that can happen over the network with low privileges. Langflow instances typically hold LLM provider API keys, database credentials and flow definitions, so a file read can lead to wider compromise of connected AI services. Short-term exploitation pressure is low: EPSS is 0.47% (61st percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Langflow has a history of being targeted once details become public, so don't treat the low score as a reason to wait. Apply the fix described in the IBM advisory (node/7290694) by upgrading beyond 1.12.2, and until then limit Langflow access to trusted users and rotate any secrets stored on the host if you suspect misuse.
What is the risk?
Rated HIGH, not critical. The attack is network-reachable, low complexity and needs no user interaction, but it requires a valid account (PR:L). Impact covers confidentiality and integrity with no availability effect. Exploitation likelihood is currently low to moderate: EPSS 0.00471 (61st percentile), not in KEV, no public PoC and no scanner template. Exposure rises sharply for multi-tenant or internet-facing Langflow deployments where many users hold accounts, and where the process has access to secrets such as .env files, API keys and mounted model or data volumes. Two caveats: no CVE-specific technical writeup was available, so which files can be read or written has not been verified, and the integrity rating suggests write access may also be possible.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade IBM Langflow OSS to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, restrict Langflow access to trusted users, put it behind SSO/VPN, and disable open self-registration. 3) Run the service as a low-privilege user in a container with a read-only root filesystem and only the volumes it needs mounted. 4) Keep secrets out of the Langflow host filesystem where possible, use a secrets manager, and rotate API keys and database credentials if there is any sign of misuse. 5) Detection: alert on requests containing '../', '..%2f' or encoded traversal sequences in Langflow API and file-related endpoints, and on unexpected file access by the Langflow process.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-103360?
IBM Langflow OSS 1.0.0 through 1.12.2 has a path traversal flaw (CWE-22) that lets any authenticated user read files outside the directories they should be able to reach, and the 8.1 CVSS score (high confidentiality and integrity impact) reflects how easily that can happen over the network with low privileges. Langflow instances typically hold LLM provider API keys, database credentials and flow definitions, so a file read can lead to wider compromise of connected AI services. Short-term exploitation pressure is low: EPSS is 0.47% (61st percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Langflow has a history of being targeted once details become public, so don't treat the low score as a reason to wait. Apply the fix described in the IBM advisory (node/7290694) by upgrading beyond 1.12.2, and until then limit Langflow access to trusted users and rotate any secrets stored on the host if you suspect misuse.
Is CVE-2026-103360 actively exploited?
No confirmed active exploitation of CVE-2026-103360 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-103360?
1) Upgrade IBM Langflow OSS to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, restrict Langflow access to trusted users, put it behind SSO/VPN, and disable open self-registration. 3) Run the service as a low-privilege user in a container with a read-only root filesystem and only the volumes it needs mounted. 4) Keep secrets out of the Langflow host filesystem where possible, use a secrets manager, and rotate API keys and database credentials if there is any sign of misuse. 5) Detection: alert on requests containing '../', '..%2f' or encoded traversal sequences in Langflow API and file-related endpoints, and on unexpected file access by the Langflow process.
What systems are affected by CVE-2026-103360?
This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM orchestration platforms, Low-code AI workflow builders.
What is the CVSS score for CVE-2026-103360?
CVE-2026-103360 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.49%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0049Exploit Public-Facing ApplicationAML.T0055Unsecured CredentialsCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
Exploitation Scenario
An attacker obtains low-privilege access to a shared Langflow server, for example through a leaked or self-registered account. They send crafted requests to a file-handling endpoint using traversal sequences to escape the allowed directory. They read the .env file and configuration files to get LLM provider keys and vector database credentials. They then use those credentials to query internal knowledge bases, run up API costs, or access production data. If write access is also possible, they could change flow definitions to persist their access.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PrimaryCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow