Is CVE-2026-7646 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-7646?

CVE-2026-7646 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-7646

Description

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.