Loading vulnerability…
Authenticated path traversal in IBM Langflow OSS
CVE-2026-103360 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. Improper restriction of pathnames to an intended directory allows a remote authenticated attacker to access sensitive information outside that directory. The affected function and exact input mechanism are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information outside the intended restricted directory to an authenticated remote attacker. The specific files, information exposed, and extent of disclosure are not identified.
If you can’t patch tonight, do this now.
No vendor-provided workaround is identified. Interim risk-reduction measures include restricting network access to trusted users, limiting application filesystem permissions to necessary directories, and reviewing access controls for sensitive files. These measures are not confirmed fixes.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.3 or later, following the IBM security bulletin's remediation instructions. The bulletin recommends version 1.12.3 to address the listed vulnerabilities, although the individual advisory does not identify a fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.