CVE-2026-7528 HIGH

CVE-2026-7528: Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS

Vendor Ibm

Product Langflow OSS

Weakness CWE-400

Published May 27, 2026

Last update May 27, 2026

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.

Key dates

May 27, 2026 CVE published

May 27, 2026 Record updated

External resources

Related vulnerabilities