{"id":"CVE-2026-110244","kind":"vulnerability","aliases":["CVE-2026-110244"],"related":[],"title":"Langflow: path traversal lets signed-in users read sensitive files","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 does not keep file paths inside their intended directory. A logged-in attacker can use this to obtain sensitive information from the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"langflow","fixed":["1.12.5"],"affected":">= 1.0.0, <= 1.12.4","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","auth-required","langflow","python","self-hosted"],"not_affected_if":["langflow-1.12.5-or-later","no-untrusted-logins","unauthenticated-only-access","versions-outside-range"],"how_to_check":"Run 'pip show langflow' or 'langflow --version'; any version from 1.0.0 to 1.12.4 is affected, 1.12.5 or later is fixed. Anyone with a login on the instance can reach the flaw.","fix":"Upgrade Langflow OSS to 1.12.5 (pip install -U 'langflow>=1.12.5'); back up the install and test flows first.","status":"open","published_at":"2026-10-29T16:17:56+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:29:12+00:00","updated_at":"2026-10-29T16:30:42+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-29T16:29:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Langflow: path traversal lets signed-in users read sensitive files","impact":"medium","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 does not keep file paths inside their intended directory. A logged-in attacker can use this to obtain sensitive information from the server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive files from the Langflow server","analyst_note":"Confirm the fixed version and any workaround from the IBM advisory and the NVD entry, and whether the flaw is reachable only with a specific feature enabled.","how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`; versions `1.0.0` through `1.12.4` are in scope\n- unknown whether other checks apply; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","versions-outside-range"],"who_is_affected":"Teams that run Langflow OSS between versions 1.0.0 and 1.12.4 on a server reachable by users with accounts. The sources do not describe a specific configuration; they say a remote authenticated attacker is needed. Deployments outside those versions are not in scope.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4102,"output_tokens":536,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the IBM advisory and the NVD entry, and whether the flaw is reachable only with a specific feature enabled.","search":"'-110244':14A,17A '-2026':13A,16A '1.0.0':33B,63C '1.12.4':35B,65C 'ai':20B 'ai-tool':19B 'allow':67C 'attack':49B,71C 'auth':23B 'auth-requir':22B 'authent':70C 'could':66C 'cve':12A,15A 'directori':44B,86C 'due':76C 'file':11A,39B 'host':29B 'ibm':30B,60C 'improp':78C 'inform':56B,75C 'insid':41B 'intend':43B 'keep':38B 'langflow':1A,18A,25B,31B,61C 'let':4A 'limit':79C 'log':47B 'logged-in':46B 'obtain':54B,73C 'oss':32B,62C 'path':2A,40B 'pathnam':82C 'python':26B 'read':9A 'remot':69C 'requir':24B 'restrict':85C 'self':28B 'self-host':27B 'sensit':10A,55B,74C 'server':59B 'sign':6A 'signed-in':5A 'tool':21B 'travers':3A 'use':51B 'user':8A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Langflow OSS 1.0.0 to 1.12.4 where more than one person, or any untrusted user, has a login. A signed-in user can read files the Langflow server process can read, such as secret keys and credentials. IBM does not name a specific feature or setting that is required. Single-user local installs and instances no untrusted person can log in to are lower risk, but should still upgrade.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:30:42Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7293016","run_id":1048},"products":{"at":"2026-10-29T16:30:42Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7293016","run_id":1048}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110244","severity":null,"published_at":"2026-10-29T16:17:56+00:00","modified_at":"2026-10-29T16:17:56+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110244:1048","url":null,"severity":null,"published_at":"2026-10-29T16:30:42+00:00","modified_at":"2026-10-29T16:30:42+00:00","first_seen_at":"2026-10-29T16:30:42+00:00","fetched_at":"2026-10-29T16:30:42+00:00","note":"IBM bulletin (node/7293016, 19 Oct 2026) lists this CVE, affected 1.0.0-1.12.4, fix 1.12.5. No feature gate or workaround stated for this CVE; the MCP stdio env settings in the bulletin are for other CVEs. IBM scores it 6.5 but gives a vector that computes to 8.8; severity left unchanged. No exploitation or PoC found; no X search done. Sibling path traversal CVE-2026-110190 is in the same bulletin."}],"documents":[{"id":17746,"url":"https://www.ibm.com/support/pages/node/7293016","title":"IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (19 Oct 2026)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}