{"data":{"id":"dda9fa85-6790-465b-8305-2747a1f13791","title":"CVE-2026-7658: IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path…","summary":"CVE-2026-7658 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. The username field is not properly validated, so attackers can inject path traversal sequences and bypass containment checks. Reported impacts include arbitrary directory deletion, cross-tenant data destruction, and deletion of the JWT signing key, which invalidates sessions.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7658","publishedAt":"2026-08-05T19:17:43.580Z","cveId":"CVE-2026-7658","cweIds":["CWE-22"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS path traversal via unvalidated username field","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00508,"epssCheckedAt":"2026-11-09T06:13:51.964Z","kevDateAdded":null,"advisoryAliases":["GHSA-59wg-6v2q-cr6p"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T12:10:53.960Z","patchAvailable":null,"disclosureDate":"2026-08-05T19:17:43.580Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}