PT-2026-60862

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An authenticated attacker can read arbitrary files, including the JWT signing key. This allows the attacker to forge authentication tokens for any user. JWT JSON Web Token is a compact...

CVE-2026-7872: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...