CVE-2026-7646: IBM Langflow Path Traversal Vulnerability

CVE-2026-7646 Overview

CVE-2026-7646 is a path traversal vulnerability [CWE-22] in IBM Langflow OSS versions 1.0.0 through 1.10.3. Authenticated users can read arbitrary files from the server filesystem by sending a crafted Model Context Protocol (MCP) resources/read request that contains a URL-encoded traversal sequence in the filename parameter. Exposed data includes other users' uploaded documents, the JSON Web Token (JWT) signing secret, the SQLite database, and process environment variables. Disclosure of the JWT signing secret enables attackers to forge session tokens and impersonate other users, escalating the impact beyond simple file read.

Critical Impact
Authenticated attackers can read arbitrary server files, including the JWT signing secret, enabling user impersonation across the Langflow instance.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.3
Deployments exposing the MCP resources/read endpoint
Multi-tenant Langflow instances storing user uploads and SQLite state

Discovery Timeline

2026-08-05 - CVE-2026-7646 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7646

Vulnerability Analysis

The flaw resides in the MCP resources/read handler in IBM Langflow OSS. The handler accepts a filename parameter and resolves it against the server filesystem without normalizing or validating the resulting path. Because the parameter is URL-decoded before the path check, attackers can smuggle traversal sequences such as %2e%2e%2f past superficial filters. The handler then opens and returns the target file to the requesting user.

Exploitation requires only low-privilege authenticated access over the network and does not need user interaction. Successful requests disclose sensitive artifacts including the JWT signing secret used to authenticate sessions. With the signing secret in hand, an attacker forges tokens for any account, converting an information disclosure issue into full account takeover across the tenant.

Root Cause

The root cause is missing path canonicalization and allow-listing on the filename argument to resources/read. Langflow trusts client-supplied paths after URL decoding and never confirms that the resolved path stays within an approved resource directory.

Attack Vector

An authenticated user sends an MCP resources/read request whose filename contains a URL-encoded traversal payload such as ..%2f..%2f..%2fetc%2fpasswd or a path pointing to Langflow's SQLite database and JWT secret file. The server decodes the value, walks out of the intended directory, and returns the file contents in the response. See the IBM Support Advisory for technical details.

// No verified proof-of-concept code is published for CVE-2026-7646.
// Refer to the IBM Support Advisory for exploitation and remediation details.

Detection Methods for CVE-2026-7646

Indicators of Compromise

MCP resources/read requests containing URL-encoded traversal sequences such as %2e%2e%2f, %2e%2e/, or ..%2f in the filename parameter
Access log entries where Langflow returns non-flow assets such as langflow.db, .env, or JWT secret files
Sudden appearance of valid JWTs issued for accounts that did not authenticate through the login flow

Detection Strategies

Inspect Langflow application and reverse proxy logs for resources/read calls whose filename argument contains encoded dot-dot sequences or absolute paths
Alert on responses from resources/read that return content types or sizes inconsistent with expected flow resources
Correlate file-read requests with subsequent authentication events from the same source to identify token forgery follow-on activity

Monitoring Recommendations

Enable verbose MCP request logging and forward logs to a centralized analytics pipeline for retention and search
Baseline normal resources/read traffic per user and flag deviations in path patterns or request volume
Monitor filesystem access to sensitive paths such as the SQLite database, .env files, and any directory storing signing keys

How to Mitigate CVE-2026-7646

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release above 1.10.3 as directed in the IBM Support Advisory
Rotate the JWT signing secret and invalidate all active sessions after patching
Rotate any credentials, API keys, or database contents that may have been exposed through resources/read
Restrict Langflow network exposure to trusted users while remediation is in progress

Patch Information

IBM has published remediation guidance for CVE-2026-7646 in the IBM Support Advisory. Apply the vendor-provided fixed version for IBM Langflow OSS and follow the advisory's post-upgrade steps.

Workarounds

Place Langflow behind a reverse proxy or web application firewall that blocks requests with URL-encoded traversal sequences in MCP endpoints
Run the Langflow process under a dedicated low-privilege account with filesystem access limited to required directories
Move the SQLite database, .env file, and signing secrets outside the Langflow working directory and enforce restrictive filesystem permissions

bash

# Example reverse proxy rule to block URL-encoded traversal on the MCP endpoint
location /api/v1/mcp/ {
    if ($request_uri ~* "(%2e%2e|\.\./|%2f\.\.)") {
        return 400;
    }
    proxy_pass http://langflow_upstream;
}