CVE-2026-110244

Langflow path confinement failure exposes information

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

Unauthorized information disclosure; broader impacts in the score are not independently demonstrated.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary records do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A pathname can escape its intended directory; the public description establishes information disclosure, not a demonstrated execution chain.

Conditions required

A remote authenticated user can reach the affected path-handling feature.

Potential impact

Unauthorized information disclosure; broader impacts in the score are not independently demonstrated.

Affected versions and configurations

IBM lists Langflow OSS 1.0.0 through 1.12.4.

Fix and mitigation status

1.12.5 per IBM; this is an issue-specific fix, not assurance that the old release addresses later findings.

Practical next steps

Upgrade to a current supported release containing the fix; back up the deployment and validate workflow behavior. Where MCP stdio is used, IBM additionally requires interpreter hardening and administrator-only controls; configuration changes do not replace upgrading.

Operating lesson

Check canonical paths at use and minimize filesystem access.

Evidence and limits

IBM bulletin 7293016 was initially published 2026-10-19; the CNA record followed on 2026-10-29. Earlier upstream patches are not assigned to this CVE by inference. Exact technical details absent from the public record remain unknown; a CVSS score is not an observed incident. The CNA scores 8.8, while the bulletin prints 6.5 beside the same high-impact vector. Displayed severity follows the CNA; the narrative establishes file disclosure only.

Sources