Live › vulnerability › CVE-2026-104309
IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to restrict file paths to the intended directory. A logged-in attacker can use this to obtain sensitive information from the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running IBM Langflow OSS in the affected range, reachable by an authenticated user. The sources do not say which feature or path is involved, so whether a default install is exposed is unknown. Instances that do not run the affected versions can skip it.
No product ranges from the sources yet.
langflow --version or the package manager, and see whether it falls in 1.0.0 through 1.12.3.1.12.3; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-104309")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.