AI Threat AlertCVE-2026-14470: Langflow: auth'd path traversal reads arbitrary files
MEDIUMIBM Langflow, an open-source visual builder for LLM/agent pipelines, contains a directory traversal flaw (CWE-22) where an authenticated user can send a crafted URL with "../" sequences to read arbitrary files on the host, including configuration files, environment variables, and stored credentials. There's no public EPSS score, no CISA KEV listing, and no known public exploit or Nuclei template today, so this isn't being mass-exploited — but the bar to trigger it is low (network access, low privileges, zero user interaction, CVSS 6.5) and Langflow instances routinely hold high-value secrets like LLM provider API keys, vector database credentials, and flow definitions that embed downstream service tokens. Any organization running Langflow to orchestrate RAG pipelines or agentic workflows should treat any authenticated account — even a low-privilege one — as a potential vector to your LLM API keys and vector DB credentials. Patch to the fixed release referenced in IBM's advisory (beyond 1.10.2), and until patched, restrict authenticated access to trusted users and monitor logs for encoded traversal sequences (%2e%2e%2f, ../) in requests to Langflow endpoints.
What is the risk?
Medium severity per CVSS (6.5) but with meaningful blast radius: confidentiality impact is high (arbitrary file read) while integrity and availability are unaffected. The attack requires low privileges and no user interaction, and is exploitable purely over the network with low complexity — meaning any authenticated user, including a low-tier or self-registered account, can attempt it. Absence of EPSS data, KEV listing, public PoC, or scanner coverage suggests exploitation is not yet observed in the wild, but the vulnerability class (path traversal) is trivial to weaponize once an attacker has any valid credential, so risk should be treated as higher than the raw CVSS number implies for any internet-facing or multi-tenant Langflow deployment.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade Langflow to the version that remediates this issue (per IBM's advisory, any release beyond 1.10.2). Until patched, restrict who can authenticate to Langflow instances (disable self-registration if not needed, enforce least-privilege accounts), and place the application behind a WAF or reverse proxy rule that blocks encoded traversal sequences (../, %2e%2e%2f, ..%2f) in request paths. Audit application and access logs for anomalous file-path parameters in requests, and rotate any credentials (LLM API keys, DB connection strings) stored in configuration files accessible to the Langflow process, since exposure can't be ruled out retroactively without patch/version history review.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-14470?
IBM Langflow, an open-source visual builder for LLM/agent pipelines, contains a directory traversal flaw (CWE-22) where an authenticated user can send a crafted URL with "../" sequences to read arbitrary files on the host, including configuration files, environment variables, and stored credentials. There's no public EPSS score, no CISA KEV listing, and no known public exploit or Nuclei template today, so this isn't being mass-exploited — but the bar to trigger it is low (network access, low privileges, zero user interaction, CVSS 6.5) and Langflow instances routinely hold high-value secrets like LLM provider API keys, vector database credentials, and flow definitions that embed downstream service tokens. Any organization running Langflow to orchestrate RAG pipelines or agentic workflows should treat any authenticated account — even a low-privilege one — as a potential vector to your LLM API keys and vector DB credentials. Patch to the fixed release referenced in IBM's advisory (beyond 1.10.2), and until patched, restrict authenticated access to trusted users and monitor logs for encoded traversal sequences (%2e%2e%2f, ../) in requests to Langflow endpoints.
Is CVE-2026-14470 actively exploited?
No confirmed active exploitation of CVE-2026-14470 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-14470?
Upgrade Langflow to the version that remediates this issue (per IBM's advisory, any release beyond 1.10.2). Until patched, restrict who can authenticate to Langflow instances (disable self-registration if not needed, enforce least-privilege accounts), and place the application behind a WAF or reverse proxy rule that blocks encoded traversal sequences (../, %2e%2e%2f, ..%2f) in request paths. Audit application and access logs for anomalous file-path parameters in requests, and rotate any credentials (LLM API keys, DB connection strings) stored in configuration files accessible to the Langflow process, since exposure can't be ruled out retroactively without patch/version history review.
What systems are affected by CVE-2026-14470?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.
What is the CVSS score for CVE-2026-14470?
CVE-2026-14470 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.45%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0049Exploit Public-Facing ApplicationAML.T0055Unsecured CredentialsCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Exploitation Scenario
An attacker obtains a low-privileged authenticated account on a Langflow instance — for example through open self-registration, a leaked low-tier credential, or a compromised collaborator account. They then send a crafted HTTP request containing "../" sequences to a Langflow endpoint that handles file paths, retrieving files outside the intended directory such as the application's .env file or flow configuration JSON. These files commonly contain LLM provider API keys and vector database credentials embedded in the flow definitions. The attacker uses the harvested credentials to access the organization's connected LLM APIs or vector store directly, resulting in data leakage and potential downstream cost or data exposure beyond the Langflow instance itself.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimaryCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow