{"id":"CVE-2026-110190","kind":"vulnerability","aliases":["CVE-2026-110190"],"related":[],"title":"Langflow: authenticated users can read arbitrary files via directory traversal","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in user traverse directories through a crafted URL request. An attacker can use this to view arbitrary files on the server.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Langflow OSS","fixed":["1.12.5"],"affected":">= 1.0.0, <= 1.12.4","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-apps","ai-tooling","auth-required","langflow","self-hosted"],"not_affected_if":["managed-hosting","version-outside-range"],"how_to_check":"Run 'pip show langflow' or 'langflow --version'. Versions 1.0.0 through 1.12.4 are affected; 1.12.5 is fixed.","fix":"Upgrade Langflow OSS to 1.12.5 (IBM). Back up the installation and test flows after upgrading.","status":"open","published_at":"2026-10-29T16:17:55+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:31:25+00:00","updated_at":"2026-10-29T16:32:52+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-29T16:31:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Langflow: authenticated users can read arbitrary files via directory traversal","impact":"medium","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in user traverse directories through a crafted URL request. An attacker can use this to view arbitrary files on the server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","ai-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads arbitrary files from the server filesystem","analyst_note":"Find the vulnerable endpoint and the fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110190 or IBM's advisory.","how_to_check":"- Check the installed Langflow version with `langflow --version` or the package manager, and see whether it falls in 1.0.0 through 1.12.4.\n- unknown for other checks; the sources do not say which endpoint or setting is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","version-outside-range"],"who_is_affected":"Teams running self-hosted IBM Langflow OSS in the affected range where users hold accounts. The sources do not name the specific endpoint or configuration, so exposure beyond the version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4102,"output_tokens":536,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the vulnerable endpoint and the fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110190 or IBM's advisory.","search":"'-110190':13A,16A '-2026':12A,15A '1.0.0':36B,67C '1.12.4':38B,69C 'ai':20B,23B 'ai-app':19B 'ai-tool':22B 'allow':71C 'app':21B 'arbitrari':6A,59B,92C 'attack':53B,82C 'auth':26B 'auth-requir':25B 'authent':2A,73C 'could':70C,83C 'craft':49B,87C 'cve':11A,14A 'directori':9A,46B,77C 'file':7A,60B,93C 'host':31B 'ibm':32B,64C 'langflow':1A,17A,28B,33B,65C 'let':39B 'log':42B 'logged-in':41B 'oss':18A,34B,66C 'read':5A 'request':51B,89C 'requir':27B 'self':30B 'self-host':29B 'send':84C 'server':63B 'special':86C 'system':80C,96C 'tool':24B 'travers':10A,45B,76C 'url':50B,88C 'use':55B 'user':3A,44B,74C 'version':35B 'via':8A 'view':58B,91C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Langflow OSS 1.0.0 through 1.12.4 where people can log in. Any authenticated user, even low-privileged, may be able to read arbitrary files the Langflow process can reach, such as config and secrets. IBM's bulletin does not name the endpoint. Skip it if you are already on 1.12.5 or later, or if you run no Langflow OSS.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:32:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-1","run_id":1056},"products":{"at":"2026-10-29T16:32:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-1","run_id":1056},"how_to_check":{"at":"2026-10-29T16:32:52Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-1","run_id":1056}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110190","severity":null,"published_at":"2026-10-29T16:17:55+00:00","modified_at":"2026-10-29T16:17:56+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110190:1056","url":null,"severity":null,"published_at":"2026-10-29T16:32:52+00:00","modified_at":"2026-10-29T16:32:52+00:00","first_seen_at":"2026-10-29T16:32:52+00:00","fetched_at":"2026-10-29T16:32:52+00:00","note":"IBM bulletin (19 Oct 2026, bundle of many Langflow CVEs) lists CVE-2026-110190 as CWE-22, 1.0.0-1.12.4, fix 1.12.5. No endpoint named, no exploitation or PoC found, no mitigation specific to this CVE (listed workarounds are for MCP stdio). Social search skipped."}],"documents":[{"id":17755,"url":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-1","title":"IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (1.12.5)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}