CVE-2026-55447: Langflow TAR symlink traversal

Q: Is CVE-2026-55447 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55447, increasing the risk of exploitation.

Q: How to fix CVE-2026-55447?

1. Patch immediately: upgrade to Langflow 1.9.2 (PR #12945 patches `_unpack_bundle` to reject symlinks, hardlinks, and non-regular TAR entries). 2. If patching is blocked: disable or gate all BaseFileComponent-derived nodes (Read File, Docling, NvidiaIngest, UnstructuredAPI, VideoFile) behind admin-only access controls. 3. Rotate secrets: audit and rotate the Langflow JWT signing secret (`secret_key` file) on any instance that processed untrusted file uploads prior to patching. 4. Detection: query vector database contents for strings matching sensitive path patterns (`/etc/passwd`, `secret_key`, `eyJ` JWT header prefix) or unexpected base64 blobs; review ingestion logs for TAR uploads from external or untrusted users. 5. Harden runtime: run the Langflow process as a non-root user with read-only bind mounts excluding the secret key path, limiting symlink traversal reach even if a bypass is discovered.

Q: What systems are affected by CVE-2026-55447?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, document ingestion pipelines, LLM application frameworks, AI chatbot deployments, multi-modal agent frameworks.

Q: What is the CVSS score for CVE-2026-55447?

CVE-2026-55447 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.47%.

CISO Take

A critical path traversal via symlink-following in Langflow's TAR extraction (CVSS 9.6, Scope Changed) allows any user who can upload files to a RAG-enabled Langflow instance to read arbitrary files from the host filesystem — including the application's JWT signing secret. With no privileges required and a fully public PoC including a demo video, the blast radius is severe: once the JWT secret is exfiltrated via the RAG chatbot, an attacker can forge tokens for any user ID and achieve remote code execution through Langflow's built-in Python Interpreter node — all without any further vulnerability. This package carries 53 known CVEs and is widely deployed in enterprise RAG architectures, amplifying organizational exposure. Upgrade immediately to Langflow 1.9.2, which patches `BaseFileComponent._unpack_bundle` to reject symlinks and hardlinks; if patching is blocked, restrict file upload access to fully trusted users and rotate the JWT secret on any instance that processed untrusted TAR uploads.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical. The 4-stage kill chain is fully documented and weaponized: malicious TAR upload triggers symlink traversal, reads JWT secret into vector store, chatbot surfaces the secret on demand, forged admin JWT unlocks Python Interpreter RCE. The CVSS Scope Change (S:C) is the key signal — the compromise escapes the application boundary. No privileges are required to trigger the initial upload in typical public-facing RAG deployments. The combination of a public PoC, no KEV listing yet (meaning defenders may not be actively prioritizing it), and broad deployment in enterprise RAG scenarios makes this a high-urgency patching target. Containerized deployments offer partial mitigation only if the JWT secret is not on a host-mounted volume.

How does the attack unfold?

Malicious Upload

Attacker crafts a TAR archive containing a symlink targeting Langflow's JWT secret key file and uploads it via the public-facing RAG file ingestion endpoint — no authentication required.

AML.T0049

Symlink Traversal

Langflow's `BaseFileComponent._unpack_bundle` follows the symlink during extraction, reads the JWT secret from the host filesystem, and persists its contents in the connected vector database.

AML.T0037

Credential Exfiltration

Attacker prompts the RAG chatbot to surface the ingested document, causing the LLM to return the JWT signing secret verbatim from the vector store.

AML.T0082

Remote Code Execution

Attacker forges an admin JWT token using the stolen secret, creates a Langflow flow with a Python Interpreter node containing arbitrary code, and executes it to achieve full host compromise.

AML.T0050

Malicious Upload

Attacker crafts a TAR archive containing a symlink targeting Langflow's JWT secret key file and uploads it via the public-facing RAG file ingestion endpoint — no authentication required.

AML.T0049

Symlink Traversal

Langflow's `BaseFileComponent._unpack_bundle` follows the symlink during extraction, reads the JWT secret from the host filesystem, and persists its contents in the connected vector database.

AML.T0037

Credential Exfiltration

Attacker prompts the RAG chatbot to surface the ingested document, causing the LLM to return the JWT signing secret verbatim from the vector store.

AML.T0082

Remote Code Execution

Attacker forges an admin JWT token using the stolen secret, creates a Langflow flow with a Python Interpreter node containing arbitrary code, and executes it to achieve full host compromise.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.9.2	`1.9.2`
152.7K Pushed 2d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

5 steps

Patch immediately: upgrade to Langflow 1.9.2 (PR #12945 patches _unpack_bundle to reject symlinks, hardlinks, and non-regular TAR entries).
If patching is blocked: disable or gate all BaseFileComponent-derived nodes (Read File, Docling, NvidiaIngest, UnstructuredAPI, VideoFile) behind admin-only access controls.
Rotate secrets: audit and rotate the Langflow JWT signing secret (secret_key file) on any instance that processed untrusted file uploads prior to patching.
Detection: query vector database contents for strings matching sensitive path patterns (/etc/passwd, secret_key, eyJ JWT header prefix) or unexpected base64 blobs; review ingestion logs for TAR uploads from external or untrusted users.
Harden runtime: run the Langflow process as a non-root user with read-only bind mounts excluding the secret key path, limiting symlink traversal reach even if a bypass is discovered.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Data Extraction Framework RAG Agent AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0082 - RAG Credential Harvesting AML.T0085.000 - RAG Databases AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity Article 9 - Risk Management System

ISO 42001

A.6.1.2 - AI Risk Assessment A.8.2 - AI System Operation — Security Controls

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain AI system value and address negative impacts

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure LLM03:2025 - Supply Chain

Frequently Asked Questions

What is CVE-2026-55447?

A critical path traversal via symlink-following in Langflow's TAR extraction (CVSS 9.6, Scope Changed) allows any user who can upload files to a RAG-enabled Langflow instance to read arbitrary files from the host filesystem — including the application's JWT signing secret. With no privileges required and a fully public PoC including a demo video, the blast radius is severe: once the JWT secret is exfiltrated via the RAG chatbot, an attacker can forge tokens for any user ID and achieve remote code execution through Langflow's built-in Python Interpreter node — all without any further vulnerability. This package carries 53 known CVEs and is widely deployed in enterprise RAG architectures, amplifying organizational exposure. Upgrade immediately to Langflow 1.9.2, which patches `BaseFileComponent._unpack_bundle` to reject symlinks and hardlinks; if patching is blocked, restrict file upload access to fully trusted users and rotate the JWT secret on any instance that processed untrusted TAR uploads.

Is CVE-2026-55447 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55447, increasing the risk of exploitation.

How to fix CVE-2026-55447?

1. Patch immediately: upgrade to Langflow 1.9.2 (PR #12945 patches `_unpack_bundle` to reject symlinks, hardlinks, and non-regular TAR entries). 2. If patching is blocked: disable or gate all BaseFileComponent-derived nodes (Read File, Docling, NvidiaIngest, UnstructuredAPI, VideoFile) behind admin-only access controls. 3. Rotate secrets: audit and rotate the Langflow JWT signing secret (`secret_key` file) on any instance that processed untrusted file uploads prior to patching. 4. Detection: query vector database contents for strings matching sensitive path patterns (`/etc/passwd`, `secret_key`, `eyJ` JWT header prefix) or unexpected base64 blobs; review ingestion logs for TAR uploads from external or untrusted users. 5. Harden runtime: run the Langflow process as a non-root user with read-only bind mounts excluding the secret key path, limiting symlink traversal reach even if a bypass is discovered.

What systems are affected by CVE-2026-55447?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, document ingestion pipelines, LLM application frameworks, AI chatbot deployments, multi-modal agent frameworks.

What is the CVSS score for CVE-2026-55447?

CVE-2026-55447 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesdocument ingestion pipelinesLLM application frameworksAI chatbot deploymentsmulti-modal agent frameworks

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0082 RAG Credential Harvesting

AML.T0085.000 RAG Databases

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.1.2, A.8.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM02:2025, LLM03:2025

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

Exploitation Scenario

An attacker targeting an enterprise's internal AI knowledge-base chatbot built on Langflow crafts a TAR archive containing a single symlink named `quarterly-report.docx` pointing to `/opt/langflow/.langflow/secret_key`. They upload this archive via the RAG ingestion endpoint — no authentication required in many deployments, as the endpoint is designed for employee document uploads. Langflow's `_unpack_bundle` extracts the archive and follows the symlink, reading the JWT secret and persisting it in the connected Chroma DB vector store alongside legitimate documents. The attacker then queries the chatbot: 'Summarize the document about the application secret key,' receiving the JWT signing secret verbatim in the LLM response. Using this secret, the attacker forges a JWT token with an arbitrary admin user ID, authenticates to the Langflow API, creates a new flow containing a Python Interpreter node pre-loaded with a reverse shell payload, executes the flow, and achieves persistent RCE on the host server.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-61 UNIX Symbolic Link (Symlink) Following Primary CWE-61 UNIX Symbolic Link (Symlink) Following Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-61 UNIX Symbolic Link (Symlink) Following

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.