CVE-2026-7646 — Langflow is affected by security vulnerabilities in Model Context Protocol features

CVE-2026-7646

Langflow is affected by security vulnerabilities in Model Context Protocol features PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.3

CWE

CWE-22

References

https://www.ibm.com/support/pages/node/7282147

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.