{"id":"CVE-2026-97677","kind":"vulnerability","aliases":["CVE-2026-97677"],"related":[],"title":"Langflow: authenticated flow authors can write and read arbitrary server files","description":"IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory.","summary":"Langflow is an open-source framework for building AI agent and LLM workflows. An authenticated user who can author flows can write attacker-chosen content into any directory the service account can write to, and read arbitrary files the service process can access, including configuration files, secrets and database files.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Langflow OSS","fixed":["1.12.3"],"affected":">= 1.0.0, <= 1.12.2","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["managed-hosting","single-trusted-author"],"how_to_check":"Run 'pip show langflow' or 'langflow --version' (or check the container image tag). Versions 1.0.0 through 1.12.2 are affected; 1.12.3 is fixed. Then check whether untrusted or less-trusted users can create or edit flows; if so, treat the instance as exposed.","fix":"Upgrade Langflow OSS to 1.12.3 or later (IBM bulletin, 2 Oct 2026). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-08T19:17:54+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","triaged_at":"2026-11-08T19:23:07+00:00","updated_at":"2026-11-08T19:23:40+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-08T19:23:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Langflow: authenticated flow authors can write and read arbitrary server files","impact":"high","summary":"Langflow is an open-source framework for building AI agent and LLM workflows. An authenticated user who can author flows can write attacker-chosen content into any directory the service account can write to, and read arbitrary files the service process can access, including configuration files, secrets and database files.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker writes files anywhere and reads secrets from disk","analyst_note":"Confirm the fixed version and any vendor advisory for CVE-2026-97677 at the IBM or Langflow release notes; sources give only the NVD description.","how_to_check":"- Check the installed Langflow version with `pip show langflow` or the container image tag; affected range is `1.0.0` through `1.12.2`.\n- Confirm whether untrusted users can create or edit flows on the instance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-trusted-author","managed-hosting"],"who_is_affected":"Teams that self-host Langflow 1.0.0 through 1.12.2 and let more than one person create or edit flows are exposed, because a flow author can reach files outside the intended sandbox. Instances used only by a single trusted builder, or that run under a service account with no writable or secret-bearing paths, carry less risk. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4595,"output_tokens":583,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory for CVE-2026-97677 at the IBM or Langflow release notes; sources give only the NVD description.","search":"'-2026':13A,16A '-97677':14A,17A '1.0.0':83C '1.12.2':85C 'access':72B,111C,131C 'account':60B,104C 'agent':38B 'ai':21B,37B 'ai-tool':20B 'also':124C 'applic':146C 'arbitrari':9A,66B,129C 'attack':52B,93C,122C 'attacker-chosen':51B 'attacker-control':92C 'authent':2A,43B,87C 'author':4A,47B,89C 'build':36B 'bypass':105C 'chosen':53B 'configur':74B,137C 'content':54B,96C,127C 'control':94C 'could':90C,123C 'craft':116C 'cve':12A,15A 'data':148C 'databas':78B,141C 'directori':57B,99C,149C 'disk':119C 'file':11A,67B,75B,79B,95C,110C,130C,138C,142C 'flow':3A,48B,88C 'framework':34B 'host':27B 'ibm':80C 'includ':73B,136C 'index':120C 'isol':112C 'langflow':1A,18A,23B,28B,81C 'llm':40B 'local':109C 'on-disk':117C 'open':32B 'open-sourc':31B 'oss':19A,82C 'platform':107C 'process':70B,135C 'python':24B 'read':8A,65B,125C 'safeguard':113C 'secret':76B,139C 'self':26B 'self-host':25B 'server':10A 'servic':59B,69B,103C,134C 'sourc':33B 'store':143C 'tool':22B 'user':44B 'via':114C 'workflow':41B 'writabl':100C 'write':6A,50B,62B,91C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Langflow OSS 1.0.0 through 1.12.2 where more than one person can log in and author flows. An authenticated flow author can write attacker-controlled content into any directory the service account can write to, and via a crafted on-disk index read files the service can access (config, secrets, database files under the data directory). Skip it if you are on 1.12.3 or later, or only a single trusted builder uses the instance.","tier":"B","verified":{"fix":{"at":"2026-11-08T19:23:41Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290694","run_id":2214},"products":{"at":"2026-11-08T19:23:41Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290694","run_id":2214},"mitigations":{"at":"2026-11-08T19:23:41Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290694","run_id":2214},"workarounds":{"at":"2026-11-08T19:23:41Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290694","run_id":2214},"how_to_check":{"at":"2026-11-08T19:23:41Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290694","run_id":2214}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["langflowoss"],"ptokens":["langflow","oss"],"labels":["aitooling","high","langflow","python","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97677':14A,17A 'arbitrari':9A 'authent':2A 'author':4A 'cve':12A,15A 'file':11A 'flow':3A 'langflow':1A,18A 'oss':19A 'read':8A 'server':10A 'write':6A","search_b":"'access':72B 'account':60B 'agent':38B 'ai':21B,37B 'ai-tool':20B 'arbitrari':66B 'attack':52B 'attacker-chosen':51B 'authent':43B 'author':47B 'build':36B 'chosen':53B 'configur':74B 'content':54B 'databas':78B 'directori':57B 'file':67B,75B,79B 'flow':48B 'framework':34B 'host':27B 'includ':73B 'langflow':23B,28B 'llm':40B 'open':32B 'open-sourc':31B 'process':70B 'python':24B 'read':65B 'secret':76B 'self':26B 'self-host':25B 'servic':59B,69B 'sourc':33B 'tool':22B 'user':44B 'workflow':41B 'write':50B,62B","search_c":"'1.0.0':83C '1.12.2':85C 'access':111C,131C 'account':104C 'also':124C 'applic':146C 'arbitrari':129C 'attack':93C,122C 'attacker-control':92C 'authent':87C 'author':89C 'bypass':105C 'configur':137C 'content':96C,127C 'control':94C 'could':90C,123C 'craft':116C 'data':148C 'databas':141C 'directori':99C,149C 'disk':119C 'file':95C,110C,130C,138C,142C 'flow':88C 'ibm':80C 'includ':136C 'index':120C 'isol':112C 'langflow':81C 'local':109C 'on-disk':117C 'oss':82C 'platform':107C 'process':135C 'read':125C 'safeguard':113C 'secret':139C 'servic':103C,134C 'store':143C 'via':114C 'writabl':100C 'write':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97677","severity":null,"published_at":"2026-11-08T19:17:54+00:00","modified_at":"2026-11-08T19:17:54+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","fetched_at":"2026-11-08T19:22:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97677:2214","url":"https://www.ibm.com/support/pages/node/7290694","severity":null,"published_at":"2026-11-08T19:23:40+00:00","modified_at":"2026-11-08T19:23:40+00:00","first_seen_at":"2026-11-08T19:23:40+00:00","fetched_at":"2026-11-08T19:23:40+00:00","note":"IBM bulletin 7290694 (2 Oct 2026) lists CVE-2026-97677 (CWE-22, CVSS 8.1): affected 1.0.0-1.12.2, fix 1.12.3, workarounds none. No exploitation or PoC found in sources (press rewrites only). Social search skipped. Bundle of ~25 Langflow CVEs.","cites":["https://www.ibm.com/support/pages/node/7290694"]}],"documents":[{"id":103193,"url":"https://www.ibm.com/support/pages/node/7290694","title":"IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (2 Oct 2026, fix 1.12.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}