Security Advisory

CVE-2026-7646

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-05 16:25:39

Last updated 2026-08-05 17:58:02

Assigner ibm

CVSS score not scored

State PUBLISHED

Description

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.

← Browse all CVEs View on cve.org ↗