Langflow Arbitrary File Read Leading to JWT Signing Key Disclosure and Authentication Forgery

Technical Analysis

The flaw stems from insufficient path validation or access control in a file-reading feature of Langflow, permitting an already-authenticated (potentially low-privileged) user to traverse the filesystem and retrieve sensitive server-side files. Because the JWT signing secret is stored in a readable location, exposure of this key allows an attacker to craft arbitrary JWTs offline, granting themselves administrative or other users' privileges. This crosses a critical trust boundary: a low-privilege agent-platform user becomes able to impersonate any identity, including service accounts used for orchestrating agent workflows, tool access, and pipeline execution within Langflow. Since Langflow is used to build and run multi-agent/tool pipelines, forged tokens could be leveraged to hijack agent sessions, access connected tools/credentials, or manipulate flows executed under other users' contexts.

Affected Systems

IBM Langflow OSS

Detection Signatures

• Requests to file-read endpoints with path traversal sequences (../, encoded variants) targeting configuration or secret directories
• Anomalous access to files such as .env, secret_key, jwt_secret, or application config from non-admin authenticated sessions
• Unexpected JWTs presenting elevated roles/claims inconsistent with the issuing user's known privilege level
• Spike in authentication requests using tokens not issued through the standard login flow
• Log entries showing file read API calls outside expected flow/data directories

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched Langflow release beyond 1.10.0 that resolves the arbitrary file read and JWT key exposure issue.

2. 2

   Rotate JWT signing keys

   Immediately rotate the JWT signing secret/key and invalidate all previously issued tokens to prevent continued misuse of any leaked key material.

3. 3

   Restrict file access endpoints

   Apply strict path validation, canonicalization, and allow-listing on any file-read or file-serving functionality to prevent path traversal.

4. 4

   Enforce least privilege on authenticated users

   Limit which authenticated roles can access file-read APIs and audit which accounts have used these endpoints historically.

5. 5

   Store secrets outside web-accessible paths

   Move signing keys and other secrets to a secrets manager or restricted filesystem location not reachable via application file APIs.

6. 6

   Monitor authentication anomalies

   Deploy detection for tokens with unusual claims or issuance patterns to catch forged JWT usage.