CVE-2026-7646 in Langflow OSS
Summary
by MITRE • 08/05/2026
IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists in IBM Langflow Open Source Software versions 1.0.0 through 1.10.3 and represents a critical path traversal flaw that enables unauthorized file access across the server filesystem. The vulnerability specifically affects the MCP resources/read endpoint which processes URL-encoded paths without proper input validation or sanitization, allowing malicious users to craft requests that traverse directory structures and access sensitive files. The flaw stems from insufficient validation of user-supplied filenames in the resource reading functionality, creating an opportunity for attackers to bypass normal file access controls and retrieve arbitrary files from the server's filesystem.
The technical implementation of this vulnerability leverages standard path traversal techniques through URL encoding to manipulate the filename parameter in MCP requests. Attackers can exploit this by sending crafted requests that include sequences like ../ or %2e%2e%2f that when processed by the application result in directory traversal operations. The impact extends beyond simple file reading to potentially expose critical system information including other users' uploaded documents, JWT signing secrets that could compromise authentication mechanisms, SQLite database files containing sensitive user data, and process environment variables that may contain configuration details or credentials.
From an operational perspective this vulnerability presents a severe risk to system confidentiality and integrity as it allows attackers to access data they should not normally be able to retrieve. The exposure of JWT signing secrets particularly threatens the authentication security model of the application, potentially enabling attackers to forge valid tokens and gain unauthorized access to user accounts and system resources. Database file access could result in comprehensive data breaches including user credentials, personal information, and application state data that may reveal additional attack vectors or system configurations.
This vulnerability aligns with CWE-22 Path Traversal and represents a failure in input validation and access control implementation within the application's resource management functionality. The issue also maps to ATT&CK technique T1083 File and Directory Discovery as attackers can systematically explore the filesystem to identify valuable targets. Organizations should implement immediate mitigations including input sanitization of all user-supplied paths, implementing strict file access controls that prevent traversal beyond intended directories, and validating all resource requests against a whitelist of allowed paths. Additionally, regular security testing and code reviews focused on resource handling functions should be conducted to prevent similar vulnerabilities in future releases. The vulnerability highlights the importance of proper access control implementation in open source applications where user input directly influences system file operations.