AI Threat Alert
CVE-2026-7872: Langflow: path traversal enables auth token forgery
HIGHIBM Langflow, the widely-used open-source visual builder for LLM and agent workflows, contains a path traversal flaw (CWE-22) that lets an authenticated attacker read arbitrary files on the server, including the JWT signing key used to issue session tokens. With that key in hand, the attacker can forge valid authentication tokens for any user — including administrators — turning a single low-privilege account into full instance takeover. There is no public exploit or scanner template yet and the CVE is not in CISA KEV, but the attack requires no user interaction, has low complexity (CVSS 7.5, AV:N/AC:L), and the impact is total loss of authentication integrity for the deployment. Any team running self-hosted Langflow (versions 1.0.0–1.10.0) should treat this as urgent: patch to the fixed release immediately, rotate the JWT signing key and invalidate existing sessions post-patch, and in the interim restrict Langflow to trusted networks and audit accounts with any level of access since the flaw only requires an authenticated, not privileged, user.
What is the risk?
High risk despite the 'high' (not critical) CVSS score of 7.5, because the practical impact is a full authentication bypass rather than a narrow information leak. The barrier to exploitation is low (no privileges beyond a basic authenticated account, no user interaction, low attack complexity), and the payoff — a forged JWT for any user, including admins — is disproportionate to the access required to trigger it. Mitigating factors are the absence of a public PoC, no Nuclei template, and no CISA KEV listing, meaning mass exploitation has not yet been observed. However, Langflow is a popular self-hosted framework for building LLM/agent pipelines, and once a working exploit or Metasploit-style module surfaces (as has happened for other agent-framework CVEs like Flowise/BentoML), exploitation could scale quickly against internet-exposed instances.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade Langflow to a version beyond 1.10.0 that fixes the path traversal (CWE-22) as soon as IBM/Langflow publishes a patched release — track the vendor advisory at ibm.com/support/pages/node/7278934. After patching, rotate the JWT signing secret and force re-authentication for all users to invalidate any tokens that may have already been forged. As a interim workaround, restrict network access to the Langflow instance (VPN/allowlist, not public internet), review file system permissions so the signing key file is not readable by the application's file-serving/download endpoints, and audit access logs for anomalous file-read requests containing traversal sequences (
../) or requests targeting config/secret paths. Enable monitoring/alerting on authentication anomalies (e.g., admin-level actions from accounts that shouldn't have them) as a detection layer in case a forged token is already in use.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-7872?
IBM Langflow, the widely-used open-source visual builder for LLM and agent workflows, contains a path traversal flaw (CWE-22) that lets an authenticated attacker read arbitrary files on the server, including the JWT signing key used to issue session tokens. With that key in hand, the attacker can forge valid authentication tokens for any user — including administrators — turning a single low-privilege account into full instance takeover. There is no public exploit or scanner template yet and the CVE is not in CISA KEV, but the attack requires no user interaction, has low complexity (CVSS 7.5, AV:N/AC:L), and the impact is total loss of authentication integrity for the deployment. Any team running self-hosted Langflow (versions 1.0.0–1.10.0) should treat this as urgent: patch to the fixed release immediately, rotate the JWT signing key and invalidate existing sessions post-patch, and in the interim restrict Langflow to trusted networks and audit accounts with any level of access since the flaw only requires an authenticated, not privileged, user.
Is CVE-2026-7872 actively exploited?
No confirmed active exploitation of CVE-2026-7872 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-7872?
Upgrade Langflow to a version beyond 1.10.0 that fixes the path traversal (CWE-22) as soon as IBM/Langflow publishes a patched release — track the vendor advisory at ibm.com/support/pages/node/7278934. After patching, rotate the JWT signing secret and force re-authentication for all users to invalidate any tokens that may have already been forged. As a interim workaround, restrict network access to the Langflow instance (VPN/allowlist, not public internet), review file system permissions so the signing key file is not readable by the application's file-serving/download endpoints, and audit access logs for anomalous file-read requests containing traversal sequences (`../`) or requests targeting config/secret paths. Enable monitoring/alerting on authentication anomalies (e.g., admin-level actions from accounts that shouldn't have them) as a detection layer in case a forged token is already in use.
What systems are affected by CVE-2026-7872?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration workflows.
What is the CVSS score for CVE-2026-7872?
CVE-2026-7872 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.57%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012 Valid Accounts AML.T0049 Exploit Public-Facing Application AML.T0055 Unsecured Credentials AML.T0091 Use Alternate Authentication Material Compliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.
Exploitation Scenario
An attacker registers or obtains a low-privilege authenticated account on a Langflow instance (e.g., via open self-signup, a leaked credential, or an insider). Using the file-read endpoint affected by the path traversal bug, they craft a request with directory traversal sequences to fetch the file containing Langflow's JWT signing key instead of the intended in-scope file. With the signing key in hand, the attacker crafts a JWT asserting an administrator's identity and presents it to the API, which accepts it as valid since it is properly signed. They now operate with full admin rights inside Langflow — able to view or exfiltrate all stored workflows, API keys embedded in flow configurations, and connected data sources, and to plant malicious agent tools or logic for persistence.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-10561 10.0 Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflow CVE-2026-10134 10.0 Langflow: unauthenticated RCE via tool_code injection
Same package: langflow CVE-2026-33309 9.9 langflow: Path Traversal enables file access
Same package: langflow CVE-2026-55255 9.9 Langflow: IDOR allows cross-user flow execution
Same package: langflow CVE-2026-7873 9.9 Langflow: authenticated RCE enables credential theft
Same package: langflow