CVE-2026-7658

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3

Description Improper validation of the username field allows attackers to inject path traversal sequences—a technique used to access files and directories outside the intended folder—and bypass containment checks. This can lead to arbitrary directory deletion, cross-tenant data destruction, and the deletion of JWT signing keys, which results in session invalidation.

Recommendations Update IBM Langflow OSS to a version later than 1.10.3. Restrict the use of the username field until the update is applied.