CVE-2026-55447: 
Homebrew vulnerability analysis and mitigation

CVE-2026-55447 is a symlink-following vulnerability in Langflow, an AI workflow and agent-building platform, that allows attackers to read arbitrary files from the server filesystem and potentially achieve remote code execution (RCE). All versions prior to 1.9.2 are affected across six file-processing components built on BaseFileComponent: Docling (DoclingInlineComponent, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). The vulnerability was discovered by Ori Lahav (Security Researcher at Rubrik Inc.), published on June 19, 2026, and fixed in version 1.9.2. It carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Feedly).

The root cause is improper handling of symbolic links during TAR archive extraction in BaseFileComponent._unpack_bundle (located in src/lfx/src/lfx/base/data/base_file.py), classified as CWE-61 (UNIX Symbolic Link Following) and CWE-200 (Exposure of Sensitive Information). The function validated that a TAR member's name did not escape the extraction directory but did not reject symlink or hardlink members; a crafted TAR archive containing a symlink (e.g., langflow_secret -> ~/.langflow/secret_key) was extracted untouched. The post-extraction iterdir() walk then passed the symlink to process_files(), whose concrete implementations call path.read_bytes(), which follows the link and reads the target file. This issue affected all supported Python versions (3.10–3.13) because Python's tarfile module only defaults to the safe data filter in Python 3.14, which Langflow's requires-python = ">=3.10,<3.14" explicitly excluded (GitHub Advisory, PR #12945).

Successful exploitation enables an attacker to read any file on the server filesystem accessible to the Langflow process, including sensitive files such as ~/.langflow/secret_key (the JWT signing secret). With the JWT secret, an attacker can forge authentication tokens for any user — including administrators — bypassing authentication entirely. This authentication bypass then enables full RCE by creating a new Langflow flow containing a Python Interpreter node and executing arbitrary Python code on the host, resulting in complete system compromise with high confidentiality, integrity, and availability impact (GitHub Advisory, Feedly).

A detailed proof-of-concept (PoC) with step-by-step reproduction instructions, a sample exploit TAR archive, and a demonstration video is publicly available in the GitHub security advisory (GitHub Advisory). Exploitation requires user interaction — specifically, an attacker must be able to supply a file to a RAG ingestion component — but requires no authentication or special privileges. As of the time of disclosure, no in-the-wild exploitation has been confirmed, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.32–0.41%, indicating a currently low but non-trivial probability of exploitation in the near term (Feedly). Qualys has assigned detection ID 5014303 for this vulnerability.

1. Identify a target: Locate a Langflow deployment (version < 1.9.2) that exposes a RAG chatbot or file ingestion workflow using any BaseFileComponent-based component (e.g., Read File, Docling, NVIDIA Retriever Extraction).
2. Create a malicious symlink: On an attacker-controlled system, create a symbolic link pointing to a sensitive file on the Langflow server, such as the JWT secret: ln -s ~/.langflow/secret_key langflow_secret.
3. Package the symlink in a TAR archive: Compress the symlink into a TAR file: tar -cf archive.tar langflow_secret. This produces an archive containing a symlink member that passes the name-based path check but points to an arbitrary filesystem location.
4. Upload the TAR to the vulnerable component: Submit the crafted TAR archive as input to the target Langflow flow's file ingestion component (e.g., Read File connected to a Chroma DB vector store).
5. Extract the secret via the chatbot: Query the chatbot connected to the vector store for the contents of the ingested file. The RAG system returns the contents of the symlink target (e.g., the JWT signing key).
6. Forge a JWT token: Using the leaked JWT secret, craft a signed JWT token for an administrator user ID using a tool such as python-jose or jwt.io.
7. Achieve RCE: Authenticate to Langflow using the forged JWT, create a new flow containing a Python Interpreter node, populate it with arbitrary Python code (e.g., a reverse shell), and execute it to achieve full remote code execution on the host (GitHub Advisory, PR #12945).

• File System: Presence of TAR archives containing symlink members pointing to absolute paths (e.g., ~/.langflow/secret_key, /etc/passwd, /etc/shadow) in upload directories or temporary extraction paths used by Langflow.
• File System: Unexpected symlinks in Langflow's temporary extraction directories (e.g., under /tmp) pointing outside the intended extraction scope.
• Logs: Langflow application logs showing file ingestion events for TAR archives followed by unusual vector store queries requesting verbatim file contents (e.g., queries about "secret_key" or "JWT").
• Logs: Authentication events using JWT tokens for admin users that were not issued through normal login flows, particularly tokens with unusual iat (issued-at) timestamps or user IDs not matching active sessions.
• Logs: Creation of new Langflow flows containing Python Interpreter nodes by users who did not previously create such flows, especially shortly after a file ingestion event.
• Process: Unusual child processes spawned by the Langflow Python process (e.g., bash, curl, wget, python3 with unexpected arguments) indicating post-exploitation code execution (GitHub Advisory).

Upgrade Langflow to version 1.9.2 or later, which fixes the vulnerability by modifying BaseFileComponent._unpack_bundle._safe_extract_tar to reject symbolic links, hard links, FIFOs, and device-node TAR members with a ValueError, and adds post-extraction symlink filtering in _unpack_and_collect_files as defense-in-depth (PR #12945). For deployments that cannot upgrade immediately, the following mitigations should be applied: restrict filesystem permissions for the Langflow process to only the directories it requires; disable or restrict access to vulnerable file-processing components (FileComponent, DoclingInlineComponent, DoclingRemoteComponent, NvidiaIngestComponent, VideoFileComponent, UnstructuredComponent) if not essential; and implement input validation to reject TAR archives containing non-regular file entries before they reach Langflow components (GitHub Advisory, Feedly).

The vulnerability was reported by Ori Lahav, a security researcher at Rubrik Inc., and was covered by security news outlet SecurityOnline.info (SecurityOnline). The Langflow maintainers responded promptly, merging the fix on April 30, 2026, and publicly disclosing the advisory on June 19, 2026. Tenable has issued detection plugins for the vulnerability (pipeline issues 223153 and 223156, and cloud-security plugin 443680), indicating broad scanner coverage. No significant social media controversy or threat actor attribution has been publicly reported.