IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a… (CVE-2026-17622)

CVE-2026-17622 affects IBM Langflow OSS versions 1.0.0 through 1.10.2. The vulnerability arises from improper limitation of a pathname to a restricted directory, which could allow a remote attacker with valid authentication to access sensitive information. The weakness corresponds to CWE-22, a directory traversal issue. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

An authenticated remote attacker could exploit this vulnerability to access sensitive information that should be restricted. The confidentiality impact is high, but there is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the affected versions and monitor for suspicious activity involving path traversal attempts.