CVE-2026-12942: Langflow path traversal exposes

CISO Take

This is a classic directory traversal flaw (CWE-22): an unauthenticated, network-reachable attacker can send a URL containing "../" sequences to Langflow and read arbitrary files off the host filesystem, no login or user interaction required. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't under active mass exploitation today — but Langflow carries a package risk score of 77/100 and a history of 89 other CVEs, signaling a framework with a persistently weak security track record that adversaries actively probe. The real danger isn't the file read itself (CVSS 7.5, confidentiality-only impact) but what typically sits on disk next to a Langflow deployment: `.env` files, flow export JSON, and SQLite state that often embed LLM provider API keys (OpenAI, Anthropic, etc.) and database credentials. Patch to the fixed release referenced in IBM's advisory immediately, and in the meantime take any public-facing Langflow instance off the open internet or put it behind authentication/WAF rules blocking traversal patterns, then rotate any credentials the instance had access to as a precaution.

Sources: NVD ibm.com ATLAS

What is the risk?

CVSS 3.1 base score 7.5 (High) with AV:N/AC:L/PR:N/UI:N reflects trivial, unauthenticated, network exploitability — the classic profile of a mass-scanned vulnerability. Impact is confidentiality-only (C:H/I:N/A:N): no direct code execution or data tampering from this CVE alone, but arbitrary file read on a system that hosts LLM API keys, agent flow definitions, and credentials is high-value to an attacker as a stepping stone. Absence of EPSS data, KEV listing, public PoC, or a Nuclei template today means opportunistic mass exploitation hasn't been observed yet, but Langflow's dense CVE history (89 other CVEs in the package) and its popularity as a self-hosted low-code AI builder make it a recurring target once traversal PoCs circulate — treat as high-priority-to-patch rather than actively-exploited.

How does the attack unfold?

Initial Access

Attacker sends a crafted, unauthenticated HTTP request containing dot-dot-slash sequences to a public-facing Langflow endpoint.

AML.T0049

Exploitation

The endpoint fails to sanitize the path, allowing the request to escape the intended directory and read arbitrary files from the host filesystem.

AML.T0037

Discovery

Attacker retrieves configuration files, flow exports, or `.env` files that may contain embedded LLM API keys and database credentials.

AML.T0007

Impact

Exposed credentials are reused to consume LLM inference at the victim's cost or to access downstream data stores tied to the Langflow deployment.

AML.T0024

Initial Access

Attacker sends a crafted, unauthenticated HTTP request containing dot-dot-slash sequences to a public-facing Langflow endpoint.

AML.T0049

Exploitation

The endpoint fails to sanitize the path, allowing the request to escape the intended directory and read arbitrary files from the host filesystem.

AML.T0037

Discovery

Attacker retrieves configuration files, flow exports, or `.env` files that may contain embedded LLM API keys and database credentials.

AML.T0007

Impact

Exposed credentials are reused to consume LLM inference at the victim's cost or to access downstream data stores tied to the Langflow deployment.

AML.T0024

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 4d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Upgrade Langflow OSS beyond 1.10.1 to the version referenced as fixed in the IBM advisory (https://www.ibm.com/support/pages/node/7279993) — confirm the exact patched release with the vendor since it isn't specified in the CVE record. 2) Until patched, do not expose Langflow directly to the public internet; place it behind a reverse proxy/VPN and require authentication at that layer. 3) Add a WAF/reverse-proxy rule blocking URL-encoded and raw "../" traversal sequences to affected endpoints as a stopgap. 4) Audit and rotate any credentials (LLM API keys, DB passwords) stored in files reachable from the Langflow install path, since exposure can't be ruled out retroactively. 5) Review web server / application logs for historical requests containing "..%2f", "....//", or similar traversal patterns as an indicator of prior exploitation attempts.

How is it classified?

Data Leakage Data Extraction Framework Agent AML.T0007 - Discover AI Artifacts AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-12942?

This is a classic directory traversal flaw (CWE-22): an unauthenticated, network-reachable attacker can send a URL containing "../" sequences to Langflow and read arbitrary files off the host filesystem, no login or user interaction required. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't under active mass exploitation today — but Langflow carries a package risk score of 77/100 and a history of 89 other CVEs, signaling a framework with a persistently weak security track record that adversaries actively probe. The real danger isn't the file read itself (CVSS 7.5, confidentiality-only impact) but what typically sits on disk next to a Langflow deployment: `.env` files, flow export JSON, and SQLite state that often embed LLM provider API keys (OpenAI, Anthropic, etc.) and database credentials. Patch to the fixed release referenced in IBM's advisory immediately, and in the meantime take any public-facing Langflow instance off the open internet or put it behind authentication/WAF rules blocking traversal patterns, then rotate any credentials the instance had access to as a precaution.

Is CVE-2026-12942 actively exploited?

No confirmed active exploitation of CVE-2026-12942 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12942?

1) Upgrade Langflow OSS beyond 1.10.1 to the version referenced as fixed in the IBM advisory (https://www.ibm.com/support/pages/node/7279993) — confirm the exact patched release with the vendor since it isn't specified in the CVE record. 2) Until patched, do not expose Langflow directly to the public internet; place it behind a reverse proxy/VPN and require authentication at that layer. 3) Add a WAF/reverse-proxy rule blocking URL-encoded and raw "../" traversal sequences to affected endpoints as a stopgap. 4) Audit and rotate any credentials (LLM API keys, DB passwords) stored in files reachable from the Langflow install path, since exposure can't be ruled out retroactively. 5) Review web server / application logs for historical requests containing "..%2f", "....//", or similar traversal patterns as an indicator of prior exploitation attempts.

What systems are affected by CVE-2026-12942?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, low-code AI/LLM workflow builders.

What is the CVSS score for CVE-2026-12942?

CVE-2026-12942 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelineslow-code AI/LLM workflow builders

MITRE ATLAS Techniques

AML.T0007 Discover AI Artifacts

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

Exploitation Scenario

An adversary scans the internet for exposed Langflow instances (a common self-hosted AI-builder deployment pattern), then sends an HTTP request to a file-serving endpoint with a path like `/api/v1/files/../../../.env` or similar dot-dot-slash sequences. The server fails to canonicalize/validate the path and returns the contents of the `.env` file or another sensitive file on disk, handing the attacker LLM provider API keys and database credentials embedded in the Langflow deployment. The attacker then uses the exfiltrated LLM API key to run inference at the victim's expense (cost harvesting) or pivots using the database credentials to access the Langflow project's stored flows and data.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.