{"data":{"id":"818213fe-6ee7-4178-8112-05cd66cb26ee","title":"CVE-2026-7872: IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT…","summary":"CVE-2026-7872 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. An authenticated attacker can read arbitrary files, including the JWT signing key, and use that key to forge authentication tokens for any user. The weakness is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7872","publishedAt":"2026-07-17T20:17:30.377Z","cveId":"CVE-2026-7872","cweIds":["CWE-22"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS arbitrary file read by authenticated attacker","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00624,"epssCheckedAt":"2026-11-12T06:11:39.746Z","kevDateAdded":null,"advisoryAliases":["GHSA-c975-75gc-hhvw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:10:01.358Z","patchAvailable":null,"disclosureDate":"2026-07-17T20:17:30.377Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}