Advisory · CVE-2026-97677
IBM Langflow lets flow authors read secrets and write files anywhere
IBM Langflow OSS 1.0.0 through 1.12.2 lets an authenticated flow author write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard, and via a crafted on-disk index also read arbitrary files accessible to the service process, including configuration files, secrets, or database files stored under the application's data directory, rated high at CVSS 8.1.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97677
CWE-22 - Action timing
- Immediate
Explain it like I’m five
Langflow lets users build AI workflows, and it is supposed to keep their file access fenced in. A flaw lets a flow author write files anywhere the service can write and read files the service can read, including its own secrets and databases.
- 01Flow author access
An authenticated flow author reaches Langflow.
- 02Isolation bypassed
The local file access isolation safeguard is circumvented.
- 03Files written
Attacker-controlled content is written into any directory the service account can write.
- 04Files read
A crafted on-disk index exposes arbitrary files, including configuration, secrets, or database files.
What happened
IBM Langflow OSS 1.0.0 through 1.12.2 allows an authenticated flow author to write attacker-controlled file content into any directory writable by the service account, bypassing the platform’s local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process, including configuration files, secrets, or database files stored under the application’s data directory. The record rates it high at CVSS 8.1 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
IBM’s bulletin lists the affected versions and the fix. Langflow services often hold API keys and model credentials, which is exactly what this flaw reaches.
What to do
- Inventory Langflow deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Rotate API keys, model credentials, and database secrets reachable from the Langflow service.
- Review file writes and reads by the service account.
- Verify the deployed version after updating.
Management note
A low-code AI platform that can read its own secrets is a credential spill waiting to happen. Rotate the keys the service could reach.