Langflow: file-ingest components read any absolute path on the host before 1.9.2

CVSS 9.6CVE-2026-55447AI/ML frameworks & servingcurated

Impact

Every component built on BaseFileComponent - Read File, Docling and Docling Serve, NVIDIA Retriever Extraction, Video File, Unstructured API - follows an absolute path supplied through the ingested file, so whoever controls what goes into the RAG pipeline can make the node read arbitrary files off the serving host. On a GPU node that means the service account's tokens, kubeconfigs, cloud instance credentials and other tenants' model or data mounts land in the flow output. Langflow is normally run as a shared internal service, so one user's flow becomes a file-read primitive against everything the pod can see. The scope-change in the vendor vector reflects exactly that: the damage lands outside Langflow.

Who can reach it

Anyone who can get a file into a flow's ingest path or can author a flow on the Langflow instance; the vendor vector indicates user interaction (a flow run) but no privileged account.

What to do

Upgrade Langflow to 1.9.2 or later and restart the service - no node drain or host change needed. Until then, treat any Langflow instance that ingests untrusted files as able to read the whole container filesystem: keep credentials out of its pod, and rotate anything it had mounted if you suspect use.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55447 https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75 https://github.com/langflow-ai/langflow/pull/12945

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.