CVE-2026-7658: IBM Langflow Path Traversal Vulnerability

CVE-2026-7658 Overview

CVE-2026-7658 is a path traversal vulnerability [CWE-22] in IBM Langflow OSS versions 1.0.0 through 1.10.3. The application fails to validate the username field, allowing authenticated attackers to inject traversal sequences and bypass containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JSON Web Token (JWT) signing keys. Deleting the signing key invalidates all active sessions across the deployment.

Critical Impact
Authenticated attackers can traverse outside the intended user directory and delete arbitrary directories, destroy data belonging to other tenants, and invalidate all user sessions by removing the JWT signing key.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.3
Multi-tenant Langflow deployments exposing user-controlled username input
Systems relying on Langflow-managed JWT signing keys for session integrity

Discovery Timeline

2026-08-05 - CVE-2026-7658 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7658

Vulnerability Analysis

IBM Langflow OSS accepts the username value from authenticated requests and incorporates it into filesystem paths used for user-scoped storage operations. The application does not normalize the input or verify that resulting paths remain within the intended user directory. Attackers supplying values such as ../ sequences escape the containment boundary and reference directories belonging to other users or to core application data.

Because the flaw affects directory operations, including delete paths, an attacker can remove arbitrary directories the Langflow process can write to. This includes tenant data directories and the directory storing the JWT signing key. Removing the signing key forces the application to regenerate it, invalidating every issued token and terminating all active sessions.

The issue is exploitable over the network by an authenticated user with low privileges and requires no user interaction, aligning with the published attack vector.

Root Cause

The root cause is missing input validation and path canonicalization on the username field before it is joined with server-side base paths. The code trusts the client-supplied identifier and performs filesystem operations without asserting that the resolved path is a descendant of the intended parent directory.

Attack Vector

An attacker authenticates to Langflow with any valid low-privileged account. The attacker submits a request that carries a crafted username value containing traversal sequences. The server resolves the path outside the user's home directory and performs the destructive filesystem operation against the attacker-chosen target. Deleting the JWT signing key directory triggers organization-wide session invalidation.

No verified public exploit code is available. See the IBM Support Page Advisory for vendor technical details.

Detection Methods for CVE-2026-7658

Indicators of Compromise

Requests to Langflow API endpoints containing .., %2e%2e, or URL-encoded slashes within the username parameter
Unexpected deletion events on Langflow storage directories outside individual user home paths
Sudden mass session invalidation events across the Langflow tenant, indicating possible JWT signing key removal
Filesystem audit records showing the Langflow service account writing or deleting paths outside its designated data root

Detection Strategies

Enable HTTP request logging on the Langflow reverse proxy and alert on non-alphanumeric characters in the username field
Deploy filesystem integrity monitoring on directories that host Langflow tenant data and JWT key material
Correlate authentication failures spiking after a directory delete event, which suggests JWT key destruction
Review application logs for unusual delete operations initiated by low-privileged accounts

Monitoring Recommendations

Forward Langflow application, proxy, and host audit logs to a centralized analytics platform for correlation across identity and filesystem events
Baseline normal username character sets and alert on deviations that include path separators or encoded traversal sequences
Monitor process activity of the Langflow service for unlink, rmdir, and recursive delete syscalls targeting paths outside its data root

How to Mitigate CVE-2026-7658

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release as documented in the IBM Support Page Advisory
Restrict Langflow account provisioning and disable self-service registration until patched
Back up JWT signing keys and tenant data directories to enable rapid recovery if deletion occurs
Review recent audit logs for anomalous username values or unexpected directory deletions

Patch Information

IBM has published remediation guidance in the vendor advisory. Administrators should apply the fixed version listed by IBM and validate that the username field is server-side sanitized. Refer to the IBM Support Page Advisory for exact fixed version numbers and upgrade instructions.

Workarounds

Place Langflow behind a web application firewall (WAF) rule that rejects username parameters containing .., /, \, or URL-encoded equivalents
Run the Langflow process under a service account with filesystem write access restricted to its dedicated data root using mandatory access controls
Store JWT signing keys outside any directory reachable through user-scoped path construction
Enforce read-only mounts for directories that Langflow does not need to modify at runtime

bash

# Example NGINX rule blocking traversal in the username field
location /api/ {
    if ($arg_username ~* "(\.\.|%2e%2e|/|\\)") {
        return 400;
    }
    proxy_pass http://langflow_upstream;
}