Loading vulnerability…
Authenticated path traversal in IBM Langflow OSS
CVE-2026-97671 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2 that could allow a remote authenticated attacker to obtain sensitive information. The affected function, exploitable endpoint, and specific information exposed are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could disclose sensitive information to a remote authenticated attacker. The specific files or data accessible and the extent of disclosure are not specified.
If you can’t patch tonight, do this now.
No temporary workaround or mitigation is identified for the affected versions.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.3 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.