IBM Langflow MCP resources/read Path Traversal (Arbitrary File Read)

Technical Analysis

The vulnerability lies in Langflow's handling of the MCP `resources/read` method, which accepts a filename parameter used to construct a filesystem path without proper canonicalization or boundary checks. By supplying URL-encoded traversal sequences (e.g., encoded '../' segments) in the filename field, an attacker can escape the intended resource directory and read arbitrary files accessible to the server process. Because Langflow's MCP server is intended to broker access to legitimate uploaded resources for agent/tool consumption, this flaw turns a protocol-level convenience feature into a direct filesystem read primitive, crossing the trust boundary between per-user resource isolation and the underlying host. The exposure of the JWT signing secret is especially severe, as it allows forging valid authentication tokens for any user, escalating a file-read bug into full authentication bypass.

Affected Systems

IBM Langflow OSS; protocols: MCP

Detection Signatures

• MCP resources/read requests with filename parameters containing URL-encoded traversal sequences (e.g., %2e%2e%2f, %252e%252e%252f)
• Requests targeting non-standard resource paths outside expected upload directories
• Access logs showing reads of files like .env, jwt_secret, langflow.db, or /etc/passwd via MCP endpoints
• Unexpected successful reads of files not owned by the requesting user session
• Anomalous repeated resources/read calls with varying encoding patterns (fuzzing behavior)

Remediation Steps

1. 1

   Upgrade Langflow

   Update to the patched Langflow version that addresses CVE-2026-7646 as soon as it is released by IBM/Langflow maintainers.

2. 2

   Sanitize and canonicalize file paths

   Ensure the MCP resources/read handler resolves filenames to an absolute canonical path and verifies it remains within the intended resource directory before serving content.

3. 3

   Rotate JWT signing secret

   Assume the signing secret may have been exposed; rotate it immediately and invalidate existing sessions/tokens.

4. 4

   Restrict MCP server file access

   Run the Langflow MCP server with least-privilege filesystem permissions and isolate it from sensitive files such as env vars and secrets stores.

5. 5

   Add input validation and WAF rules

   Deploy filtering for URL-encoded path traversal sequences in MCP request parameters as a defense-in-depth measure until patched.

6. 6

   Audit access logs

   Review historical MCP resources/read logs for signs of exploitation and unauthorized file access.