Executive brief
IBM Langflow OSS, a tool used for building multi-agent AI applications, contains a security flaw that allows users to read sensitive files from the server. By exploiting this, an attacker can steal the system's security keys to impersonate any user, including administrators. This could lead to a total takeover of the application and unauthorized access to AI models and data.
Technical details
A path traversal vulnerability (CWE-22) exists in the File component's tar archive extraction functionality in Langflow OSS. The flaw is caused by improper validation of symbolic links within uploaded tar archives; the application performs lexical resolution on members before they are written to disk, allowing validation to pass while the subsequent extraction creates links pointing outside the intended directory. An authenticated attacker can leverage this to read arbitrary files accessible to the application process, such as the JWT signing key. With this key, the attacker can forge authentication tokens to bypass security controls and gain administrative access. The vulnerability is addressed in version 1.10.1.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.0
Timeline
- 2026-07-02: advisory: Initial publication by IBM
- 2026-07-17: disclosed: NVD publication date