CVE-2026-17622: Langflow Path Traversal Vulnerability

CVE-2026-17622 Overview

CVE-2026-17622 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.2. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. A remote authenticated attacker can exploit the vulnerability to read files outside intended directories on the host system. Successful exploitation exposes sensitive information stored on the underlying operating system, including configuration files, credentials, and application data. The vulnerability affects Langflow deployments running on macOS, Linux, and Windows hosts.

Critical Impact
An authenticated remote attacker can access sensitive files outside the intended directory, leading to disclosure of credentials, configuration data, and other host resources.

Affected Products

Langflow OSS versions 1.0.0 through 1.10.2
Deployments on Apple macOS, Linux, and Microsoft Windows hosts
Any application stack depending on vulnerable Langflow versions

Discovery Timeline

2026-09-04 - CVE-2026-17622 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-17622

Vulnerability Analysis

The vulnerability is a path traversal weakness [CWE-22] in IBM Langflow OSS. Langflow accepts pathname input from authenticated users without sufficiently constraining the resolved path to an allowed base directory. An attacker with valid credentials can supply crafted path sequences containing traversal characters such as ../ to escape the intended directory boundary. The server then resolves the manipulated path and returns file contents from arbitrary locations on the host filesystem. Because Langflow runs cross-platform, the flaw impacts installations on Linux, macOS, and Windows. The confidentiality impact is high; integrity and availability are not affected.

Root Cause

Langflow fails to normalize and validate user-supplied path parameters before performing file operations. The application does not enforce a canonical path check against an allowlisted directory, permitting relative traversal sequences to resolve outside the intended scope.

Attack Vector

Exploitation requires network access and low-privileged authentication. An attacker submits a request to a Langflow endpoint that accepts a pathname, injecting traversal segments to reference files outside the permitted directory. No user interaction is required, and the attack complexity is low. See the IBM Support Page for vendor details.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.486%.

Detection Methods for CVE-2026-17622

Indicators of Compromise

HTTP requests to Langflow endpoints containing path traversal sequences such as ../, ..\, %2e%2e%2f, or %2e%2e%5c
Access log entries showing authenticated users requesting sensitive paths such as /etc/passwd, /etc/shadow, or Windows paths like C:\Windows\win.ini
Unusual file read operations by the Langflow service process outside its installation directory

Detection Strategies

Inspect Langflow application and reverse proxy logs for encoded and unencoded traversal patterns in path or filename parameters
Correlate authenticated Langflow API activity with filesystem access events from host telemetry to identify out-of-scope file reads
Deploy web application firewall rules to flag requests containing directory traversal signatures targeting Langflow routes

Monitoring Recommendations

Enable verbose request logging on all Langflow endpoints that accept file or path parameters
Monitor Langflow service accounts for anomalous read access to system directories and credential stores
Alert on any successful HTTP 200 responses to requests containing traversal sequences

How to Mitigate CVE-2026-17622

Immediate Actions Required

Upgrade Langflow OSS to a version later than 1.10.2 as directed in the IBM advisory
Restrict network access to Langflow instances so only trusted users and networks can authenticate
Rotate credentials, API keys, and secrets accessible from the Langflow host if exploitation is suspected
Audit Langflow user accounts and revoke unnecessary access to reduce the pool of potential attackers

Patch Information

Refer to the IBM Support Page for the fixed version and remediation guidance. Apply the vendor-supplied patch to all Langflow OSS deployments running versions 1.0.0 through 1.10.2.

Workarounds

Place Langflow behind a web application firewall configured to block directory traversal patterns in request paths and parameters
Run the Langflow service under a low-privileged operating system account with filesystem access limited to required directories
Deploy Langflow inside a container or sandbox with read-only mounts for sensitive host paths

bash

# Example WAF rule pattern to block traversal sequences on Langflow routes
# ModSecurity example
SecRule REQUEST_URI|ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)" \
  "id:1017622,phase:2,deny,status:403,msg:'Path traversal attempt against Langflow (CVE-2026-17622)'"