CVE-2026-7646

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3

Description An issue allows users to read arbitrary files from the server filesystem by sending a crafted MCP resources/read request. By using a URL-encoded path traversal sequence in the filename, an attacker can access sensitive data, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update IBM Langflow OSS to a version later than 1.10.3.