Vulnerability-Lookup

CNVD-2026-32376

Vulnerability from cnvd - Published: 2026-08-18

Title

IBM Langflow OSS路径遍历漏洞（CNVD-2026-32376）

Description

IBM Langflow OSS是IBM官方集成并推广使用的‌Langflow开源版本。 IBM Langflow OSS存在路径遍历漏洞，该漏洞源于在处理MCP `resources/read`请求时未能正确验证文件名中URL编码的路径遍历序列，攻击者可利用该漏洞构造恶意请求读取服务器任意文件，包括其他用户上传的文档、JWT签名密钥、SQLite数据库及进程环境变量。

Severity

中

Patch Name

IBM Langflow OSS路径遍历漏洞（CNVD-2026-32376）的补丁

Patch Description

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://www.ibm.com/support/pages/node/7282147

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-7646

Impacted products

Name
IBM Langflow OSS >=1.0.0，<=1.10.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-7646",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-7646"
    }
  },
  "description": "IBM Langflow OSS\u662fIBM\u5b98\u65b9\u96c6\u6210\u5e76\u63a8\u5e7f\u4f7f\u7528\u7684\u200cLangflow\u5f00\u6e90\u7248\u672c\u3002\n\nIBM Langflow OSS\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u5904\u7406MCP `resources/read`\u8bf7\u6c42\u65f6\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u6587\u4ef6\u540d\u4e2dURL\u7f16\u7801\u7684\u8def\u5f84\u904d\u5386\u5e8f\u5217\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6784\u9020\u6076\u610f\u8bf7\u6c42\u8bfb\u53d6\u670d\u52a1\u5668\u4efb\u610f\u6587\u4ef6\uff0c\u5305\u62ec\u5176\u4ed6\u7528\u6237\u4e0a\u4f20\u7684\u6587\u6863\u3001JWT\u7b7e\u540d\u5bc6\u94a5\u3001SQLite\u6570\u636e\u5e93\u53ca\u8fdb\u7a0b\u73af\u5883\u53d8\u91cf\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://www.ibm.com/support/pages/node/7282147",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-32376",
  "openTime": "2026-08-18",
  "patchDescription": "IBM Langflow OSS\u662fIBM\u5b98\u65b9\u96c6\u6210\u5e76\u63a8\u5e7f\u4f7f\u7528\u7684\u200cLangflow\u5f00\u6e90\u7248\u672c\u3002\r\n\r\nIBM Langflow OSS\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u5904\u7406MCP `resources/read`\u8bf7\u6c42\u65f6\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u6587\u4ef6\u540d\u4e2dURL\u7f16\u7801\u7684\u8def\u5f84\u904d\u5386\u5e8f\u5217\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6784\u9020\u6076\u610f\u8bf7\u6c42\u8bfb\u53d6\u670d\u52a1\u5668\u4efb\u610f\u6587\u4ef6\uff0c\u5305\u62ec\u5176\u4ed6\u7528\u6237\u4e0a\u4f20\u7684\u6587\u6863\u3001JWT\u7b7e\u540d\u5bc6\u94a5\u3001SQLite\u6570\u636e\u5e93\u53ca\u8fdb\u7a0b\u73af\u5883\u53d8\u91cf\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Langflow OSS\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff08CNVD-2026-32376\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "IBM Langflow OSS \u003e=1.0.0\uff0c\u003c=1.10.3"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-7646",
  "serverity": "\u4e2d",
  "submitTime": "2026-08-06",
  "title": "IBM Langflow OSS\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff08CNVD-2026-32376\uff09"
}

CVE-2026-7646 (GCVE-0-2026-7646)

Vulnerability from cvelistv5 – Published: 2026-08-05 16:25 – Updated: 2026-08-05 17:58

Title

Langflow is affected by security vulnerabilities in Model Context Protocol features

Summary

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 17:57 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

ibm mitre root

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7282147	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Langflow OSS	Affected: 1.0.0 , ≤ 1.10.3 (semver) cpe:2.3:a:ibm:langflow_oss:1.0.0:::::::* cpe:2.3:a:ibm:langflow_oss:1.10.3:::::::*

Credits

CVEs reported to IBM: CVE-2026-8446 by odgrso (GMO CyberSecurity by Ierae, Inc.); CVE-2026-17626 by Thai Son Dinh (VinSOC Labs, (R&D).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7646",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T17:57:56.268139Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T17:58:02.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*"
          ],
          "product": "Langflow OSS",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "1.10.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CVEs reported to IBM: CVE-2026-8446 by odgrso (GMO CyberSecurity by Ierae, Inc.); CVE-2026-17626 by Thai Son Dinh (VinSOC Labs, (R\u0026amp;D)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users\u0027 uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.\u003c/p\u003e"
            }
          ],
          "value": "IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users\u0027 uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T16:25:39.442Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7282147"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM recommends upgrading to Langflow OSS 1.11.0 or newer \u003ca href=\"https://github.com/langflow-ai/langflow/releases\" rel=\"nofollow\"\u003ehttps://github.com/langflow-ai/langflow/releases\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM recommends upgrading to Langflow OSS 1.11.0 or newer  https://github.com/langflow-ai/langflow/releases"
        }
      ],
      "title": "Langflow is affected by security vulnerabilities in Model Context Protocol features"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-7646",
    "datePublished": "2026-08-05T16:25:39.442Z",
    "dateReserved": "2026-05-01T17:10:07.060Z",
    "dateUpdated": "2026-08-05T17:58:02.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-32376

CVE-2026-7646 (GCVE-0-2026-7646)

Tags

Sightings

Nomenclature

Related by attack behaviour