CVE-2026-7646
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 05, 2026
Vendor
unknown
Description
IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.