VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 17, 2026· Updated Jul 20, 2026

CVE-2026-7872

CVE-2026-7872

Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

Affected products

3
  • Langflow AI/Langflow2 versions
    cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*range: >=1.0.0,<1.10.1
    • (no CPE)range: >=1.0.0,<1.10.0
  • IBM/Langflow OSSllm-fuzzy
    Range: 1.0.0 - 1.10.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.