CVE-2026-7646: IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other u

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 has a path traversal vulnerability (a flaw where attackers can access files outside the intended directory by using special sequences like '../' in filenames). Attackers can exploit this by sending specially crafted MCP (model context protocol) requests to read sensitive files from the server, including other users' documents, authentication secrets (JWT signing keys), databases, and system environment variables.