CVE-2026-7872 is a path traversal vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. It allows an authenticated attacker to bypass pathname restrictions and read arbitrary files on the system, including the JWT signing key. Access to the JWT signing key enables the attacker to forge authentication tokens, potentially impersonating any user. The vulnerability is classified under CWE-22 and has a CVSS 3.1 base score of 7.5, indicating high severity. No vendor advisory or patch information is currently available.

An authenticated attacker can exploit this vulnerability to read arbitrary files, including the JWT signing key, which compromises the integrity of authentication tokens. This can lead to unauthorized access by forging tokens for any user, severely impacting system security and user trust. There is no indication of denial of service or data integrity loss beyond token forgery.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to file access and token usage.