CVE-2026-7872 is a path traversal vulnerability (CWE-22) in IBM Langflow OSS versions 1.0.0 through 1.10.0. An authenticated attacker can exploit this flaw to read arbitrary files on the system, including the JWT signing key. Access to the JWT signing key allows the attacker to forge authentication tokens, potentially impersonating any user. The vulnerability has a CVSS 3.1 score of 7.5, reflecting a high impact on confidentiality with no impact on integrity or availability. No official patch or remediation level has been provided by the vendor as of the published date.

The vulnerability allows an authenticated attacker to read arbitrary files, including the JWT signing key, which compromises the confidentiality of sensitive data. With the JWT signing key, the attacker can forge authentication tokens and impersonate any user, potentially gaining unauthorized access to the system. There is no reported impact on system integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to file access and token usage. Avoid exposing the application to untrusted networks and consider additional application-layer controls to limit file access.