CVE-2026-7872
published 2026-07-17CVE-2026-7872: IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens…
PriorityP355high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.57%
44.7th percentile
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | langflow_oss | 1.0.0 – 1.10.0 | — |
| langflow | langflow | >= 1.0.0 < 1.10.1 | 1.10.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Langflow OSS up to 1.10.0 information disclosure
vuldb·2026-07-17·CVSS 7.5
CVE-2026-7872 [HIGH] IBM Langflow OSS up to 1.10.0 information disclosure
A vulnerability marked as problematic has been reported in IBM Langflow OSS up to 1.10.0. This issue affects some unknown processing. This manipulation causes information disclosure.
The identification of this vulnerability is CVE-2026-7872. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.
ghsa_unreviewed·2026-07-17
CVE-2026-7872 [HIGH] CWE-22 IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-17
Published