Vulnerabilities CVE-2026-7646

CVE-2026-7646

Medium

Open

TLP:CLEAR

Langflow is affected by security vulnerabilities in Model Context Protocol features

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.

Details

CVSS Score: 6.5
EPSS Score ⓘ: 0.30%

22.8th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Confidence: 90%
Published: Aug 5, 2026
Last Modified: Aug 5, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.