{"data":{"id":"f60e5bf8-106c-4422-b65b-bb2e075ae73f","title":"CVE-2026-7646: IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other…","summary":"CVE-2026-7646 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. A user can send a crafted MCP `resources/read` request containing a URL-encoded path traversal sequence in the filename, which lets them read arbitrary files from the server filesystem. The source lists the reachable data as other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables. The weakness is classified as CWE-22, and NVD had not yet provided an assessment at publication.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7646","publishedAt":"2026-08-05T17:16:55.860Z","cveId":"CVE-2026-7646","cweIds":["CWE-22"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS path traversal via MCP resources/read request","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00499,"epssCheckedAt":"2026-11-09T12:10:45.242Z","kevDateAdded":null,"advisoryAliases":["GHSA-x37c-x545-wrmw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T12:10:59.059Z","patchAvailable":null,"disclosureDate":"2026-08-05T17:16:55.860Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}