IBM Langflow OSS Directory Traversal Vulnerability
First seen Jul 31, 2026 · Updated Jul 31, 2026 · CVSS 7.5
IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.
Technical Analysis
The vulnerability stems from insufficient sanitization of user-supplied path input in an HTTP endpoint, allowing directory traversal sequences to escape the intended file serving directory. An attacker can send a specially crafted request to read files outside the web root, such as environment files, credential stores, or Langflow's internal configuration that may contain API keys for connected LLMs, vector stores, or MCP/tool integrations. Because Langflow orchestrates agent pipelines and often stores connection secrets or flow definitions with embedded credentials, this file read primitive can cascade into full compromise of downstream tools and agent-to-agent integrations. The flaw crosses the human-interface/supply-chain boundary into the agent runtime itself, since exploitation requires no prior authentication and directly targets the framework hosting the agent logic.
Affected Systems
IBM Langflow OSS
Detection Signatures
- HTTP requests containing repeated '../' or URL-encoded '%2e%2e%2f' sequences targeting file-serving or static asset endpoints
- Web server or reverse proxy logs showing 400/403 responses for path traversal attempts followed by 200 responses on retried encodings
- Unexpected access to sensitive files such as .env, config.yaml, or credential stores via Langflow's HTTP interface
- Requests originating from unauthenticated sessions accessing file paths outside expected static directories
Remediation Steps
- 1
Upgrade Langflow
Update IBM Langflow OSS to a patched version beyond 1.10.1 that fixes the path traversal issue.
- 2
Restrict network exposure
Place Langflow instances behind authentication, a reverse proxy, or VPN, and avoid exposing the management interface directly to the internet.
- 3
Rotate secrets
Rotate any API keys, credentials, or tokens stored on or accessible from the Langflow host, since prior exposure cannot be ruled out.
- 4
Input validation and WAF rules
Deploy a web application firewall rule to block directory traversal patterns and normalize/reject encoded '..' sequences at the proxy layer as a compensating control.
- 5
Audit file access logs
Review historical access logs for suspicious traversal patterns to determine if exploitation already occurred.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.