CVE-2026-7646: Langflow path traversal

CISO Take

IBM Langflow's MCP `resources/read` endpoint fails to sanitize a URL-encoded filename parameter, letting a low-privileged authenticated user traverse the filesystem and pull arbitrary server files — including the JWT signing secret, the SQLite database, other tenants' uploaded documents, and process environment variables. This isn't a theoretical bug: a leaked JWT signing secret means an attacker can forge valid session tokens and impersonate any user, and the env var exposure can hand over LLM provider API keys or cloud credentials configured on the same host. There's no public exploit or Nuclei template yet and CISA scores it TRACK (not KEV), with EPSS at 0.3% (top 77th percentile) suggesting exploitation isn't imminent, but the low attack complexity and single CVSS gap (privilege required is low, not none) mean any multi-tenant or internet-facing Langflow instance is trivially exposed to a registered user turning into a full-tenant compromise. Patch to a version beyond 1.10.3 immediately, rotate the JWT signing secret and any credentials stored in `.env` on affected hosts, and audit MCP `resources/read` request logs for URL-encoded traversal sequences (`%2e%2e%2f`, `..%2f`) as a compromise indicator.

Sources: NVD EPSS ibm.com ATLAS

What is the risk?

CVSS 6.5 (medium) understates the practical severity for multi-tenant or shared Langflow deployments: confidentiality impact is high with no integrity or availability loss, attack complexity is low, and the only barrier is a low-privilege authenticated account — a bar most self-service or trial deployments clear by design. The real risk driver is what's readable: the JWT signing secret converts a file-read bug into a full authentication bypass, and the SQLite DB plus env vars can contain stored LLM API keys, database credentials, or third-party integration secrets. EPSS (0.3%, 77th percentile) and absence from CISA KEV indicate no evidence of active mass exploitation yet, and no public PoC or scanner template exists, giving defenders a window to patch before broad automation appears.

How does the attack unfold?

Entry point

A low-privileged authenticated user sends a crafted MCP resources/read request with a URL-encoded path traversal sequence in the filename parameter.

AML.T0049

Arbitrary file read

Langflow fails to sanitize the path, resolving it outside the intended directory and returning arbitrary server files including the JWT signing secret, SQLite DB, and env vars.

AML.T0037

Credential theft and escalation

The attacker uses the stolen JWT signing secret to forge authentication tokens and impersonate higher-privileged users or other tenants.

AML.T0055

Impact

The attacker gains cross-tenant access to uploaded documents, workflow data, and any credentials embedded in the database or environment variables.

Entry point

A low-privileged authenticated user sends a crafted MCP resources/read request with a URL-encoded path traversal sequence in the filename parameter.

AML.T0049

Arbitrary file read

Langflow fails to sanitize the path, resolving it outside the intended directory and returning arbitrary server files including the JWT signing secret, SQLite DB, and env vars.

AML.T0037

Credential theft and escalation

The attacker uses the stolen JWT signing secret to forge authentication tokens and impersonate higher-privileged users or other tenants.

AML.T0055

Impact

The attacker gains cross-tenant access to uploaded documents, workflow data, and any credentials embedded in the database or environment variables.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade Langflow beyond version 1.10.3 as soon as IBM publishes the fixed release. Until patched, restrict network/API access to the Langflow instance to trusted networks only and avoid exposing MCP endpoints to untrusted or self-service users. Immediately rotate the JWT signing secret and any credentials present in the deployment's .env/environment variables, since a prior exposure cannot be ruled out retroactively. Review the SQLite database and file storage for signs of unauthorized access. Add detection for URL-encoded path traversal sequences (%2e%2e, ..%2f, ..%5c) in requests to the MCP resources/read endpoint, and enforce least-privilege multi-tenancy isolation (separate instances per tenant) where feasible.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Privacy Violation Framework Agent AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MANAGE-4.1 - Risk Treatment and Response

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-7646?

IBM Langflow's MCP `resources/read` endpoint fails to sanitize a URL-encoded filename parameter, letting a low-privileged authenticated user traverse the filesystem and pull arbitrary server files — including the JWT signing secret, the SQLite database, other tenants' uploaded documents, and process environment variables. This isn't a theoretical bug: a leaked JWT signing secret means an attacker can forge valid session tokens and impersonate any user, and the env var exposure can hand over LLM provider API keys or cloud credentials configured on the same host. There's no public exploit or Nuclei template yet and CISA scores it TRACK (not KEV), with EPSS at 0.3% (top 77th percentile) suggesting exploitation isn't imminent, but the low attack complexity and single CVSS gap (privilege required is low, not none) mean any multi-tenant or internet-facing Langflow instance is trivially exposed to a registered user turning into a full-tenant compromise. Patch to a version beyond 1.10.3 immediately, rotate the JWT signing secret and any credentials stored in `.env` on affected hosts, and audit MCP `resources/read` request logs for URL-encoded traversal sequences (`%2e%2e%2f`, `..%2f`) as a compromise indicator.

Is CVE-2026-7646 actively exploited?

No confirmed active exploitation of CVE-2026-7646 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7646?

Upgrade Langflow beyond version 1.10.3 as soon as IBM publishes the fixed release. Until patched, restrict network/API access to the Langflow instance to trusted networks only and avoid exposing MCP endpoints to untrusted or self-service users. Immediately rotate the JWT signing secret and any credentials present in the deployment's `.env`/environment variables, since a prior exposure cannot be ruled out retroactively. Review the SQLite database and file storage for signs of unauthorized access. Add detection for URL-encoded path traversal sequences (`%2e%2e`, `..%2f`, `..%5c`) in requests to the MCP `resources/read` endpoint, and enforce least-privilege multi-tenancy isolation (separate instances per tenant) where feasible.

What systems are affected by CVE-2026-7646?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-7646?

CVE-2026-7646 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.

Exploitation Scenario

An attacker who holds or obtains a low-privilege Langflow account — self-registration, a shared demo instance, or a phished internal credential — sends a crafted MCP `resources/read` request with a URL-encoded `../../` sequence embedded in the filename parameter. The server resolves the path outside the intended upload directory and returns the contents of `.env` or the application's JWT signing secret file. Using the recovered JWT secret, the attacker forges a token for a higher-privileged user (e.g., an admin), bypassing authentication entirely. From there they pull the SQLite database to harvest workflow definitions and any embedded credentials, and read other tenants' uploaded documents — turning a single file-read bug into full account takeover and cross-tenant data theft, with the leaked env vars potentially extending the compromise to connected LLM APIs or cloud infrastructure.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.