CVE-2026-7658 - Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement · CoreCVE

Back Back to CVE browser

MEDIUM

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Published Aug 5, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.

Affected products

Vendor IBM Product Langflow OSS Default
unknown
Affected
- ≥ 1.0.0, ≤ 1.10.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
IBM	Langflow OSS	unknown	Affected ≥ 1.0.0, ≤ 1.10.3

Remediation

Vendor solution

IBM recommends upgrading to Langflow OSS 1.11.0 or newer https://github.com/langflow-ai/langflow/releases

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53553
Advisory
https://www.ibm.com/support/pages/node/7282647
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53553		Advisory
https://www.ibm.com/support/pages/node/7282647		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Aug 5, 2026

Updated Aug 5, 2026

Reserved May 1, 2026

Link CVE-2026-7658

CISA Vulnrichment

Updated Aug 5, 2026

NVD

Status Analyzed

Modified Aug 6, 2026

Link CVE-2026-7658

Red Hat

No data

ENISA EUVD

Assigner ibm

Published Aug 5, 2026

Updated Aug 5, 2026

Link EUVD-2026-53553

GitHub

No data