CVE-2026-7658 is a path traversal vulnerability (CWE-22) in IBM Langflow OSS affecting versions 1.0.0 through 1.10.3. The vulnerability arises from insufficient validation of the username field, enabling attackers to inject path traversal sequences that bypass containment checks. Exploitation can lead to severe impacts including arbitrary directory deletion, destruction of data across tenants, and deletion of the JWT signing key, which results in session invalidation. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. No known exploits are reported in the wild, and no vendor-provided patch or remediation level is currently available.

Successful exploitation allows attackers to bypass directory containment checks via path traversal, leading to arbitrary directory deletion and cross-tenant data destruction. Additionally, attackers can delete the JWT signing key, causing session invalidation. These impacts compromise data integrity and availability but do not directly affect confidentiality according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected versions and monitor for suspicious activity related to path traversal attempts. Avoid exposing the vulnerable components to untrusted networks or users with low privileges.