CVE-2026-17622: Langflow: path traversal exposes sensitive files

MEDIUM

Published September 4, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.2 fail to properly restrict pathnames to a safe base directory, allowing a remote authenticated attacker with only low privileges to read sensitive files outside the intended scope. There is no public exploit or scanner template available yet, no EPSS score has been assigned, and the CVE is not in CISA KEV, so near-term mass exploitation is unlikely — but the CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/C:H) means a low-friction, no-interaction attack path exists for anyone who already holds a valid Langflow account or API key. For organizations running Langflow as an internal LLM orchestration/agent-building platform, this matters because a single compromised or shared low-privilege credential could be pivoted into reading flow configs, stored credentials, or environment files that Langflow persists on disk. Patch to a fixed release above 1.10.2 as soon as IBM publishes one, and in the meantime restrict Langflow instance access to trusted networks/VPN and audit which users hold even low-privilege accounts.

Sources:NVDibm.com

What is the risk?

Medium severity (CVSS 6.5) with high confidentiality impact but no integrity or availability impact. Attack complexity is low and requires no user interaction, but it does require authentication (PR:L), which meaningfully reduces the exposure compared to an unauthenticated flaw. No public exploit code, no Nuclei template, and no CISA KEV listing indicate this is not yet being actively weaponized, and EPSS data is unavailable, so exploitation probability cannot be quantified. The realistic risk driver is credential sprawl: Langflow instances are often multi-tenant within a team, so any account compromise (phishing, credential reuse, leaked API key) becomes a path-traversal-enabled information disclosure vector.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker sends a request with a manipulated path parameter containing directory traversal sequences to escape the restricted directory.

Discovery

Attacker reads sensitive files outside the intended scope, such as flow configs or credential files.

AML.T0037

Impact

Harvested credentials or configuration data are reused to pivot into connected LLM APIs, vector databases, or other integrated services.

AML.T0025

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker sends a request with a manipulated path parameter containing directory traversal sequences to escape the restricted directory.

Discovery

Attacker reads sensitive files outside the intended scope, such as flow configs or credential files.

AML.T0037

Impact

Harvested credentials or configuration data are reused to pivot into connected LLM APIs, vector databases, or other integrated services.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed yesterday18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Track IBM's advisory (https://www.ibm.com/support/pages/node/7286293) for a fixed release beyond 1.10.2 and patch immediately once available. 2) Until patched, restrict network access to Langflow instances (VPN/allowlist, no direct internet exposure) and enforce least-privilege on all Langflow user accounts — assume any authenticated user, even low-privilege, can trigger this. 3) Rotate any API keys or credentials stored within Langflow flow definitions or environment files as a precaution. 4) Monitor Langflow access/application logs for anomalous file path parameters (sequences like '../', encoded traversal patterns) in requests. 5) Avoid storing secrets directly in flow files; use a secrets manager/vault integration where Langflow supports it.

How is it classified?

Data LeakageAuth BypassFrameworkAgentAML.T0037- Data from Local System AML.T0084- Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4-AI system data security

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-17622?

Is CVE-2026-17622 actively exploited?

No confirmed active exploitation of CVE-2026-17622 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17622?

1) Track IBM's advisory (https://www.ibm.com/support/pages/node/7286293) for a fixed release beyond 1.10.2 and patch immediately once available. 2) Until patched, restrict network access to Langflow instances (VPN/allowlist, no direct internet exposure) and enforce least-privilege on all Langflow user accounts — assume any authenticated user, even low-privilege, can trigger this. 3) Rotate any API keys or credentials stored within Langflow flow definitions or environment files as a precaution. 4) Monitor Langflow access/application logs for anomalous file path parameters (sequences like '../', encoded traversal patterns) in requests. 5) Avoid storing secrets directly in flow files; use a secrets manager/vault integration where Langflow supports it.

What systems are affected by CVE-2026-17622?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration.

What is the CVSS score for CVE-2026-17622?

CVE-2026-17622 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0084Discover AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.4

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Exploitation Scenario

An attacker obtains or is issued a low-privilege Langflow account (e.g., via a shared team instance, a leaked invite link, or a compromised low-tier credential from credential stuffing). Using that authenticated session, the attacker crafts a request to a Langflow endpoint that accepts a file path parameter, inserting directory traversal sequences to escape the intended storage directory. This lets them read files elsewhere on the host filesystem — potentially other users' flow exports containing embedded LLM provider API keys, vector database connection strings, or configuration files. The attacker then reuses those harvested credentials to pivot into the organization's actual LLM APIs or vector stores, turning a low-severity information disclosure into a broader AI supply chain compromise.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.