IBM Langflow CVE-2026-19286

Exploitation requires network access to the Langflow A2A public endpoint on an affected instance (versions 1.0.0-1.11.1); per the description, the flaw is improper enforcement of security restrictions on that specific endpoint, so the A2A endpoint must be present and reachable from the attacker. Per the CVSS vector no authentication and no user interaction are needed (PR:N/UI:N, AC:L), so default reachable deployments are directly exploitable. The main limiting factor is exposure of the A2A endpoint: instances that firewall it, place it behind authentication, or do not expose A2A externally sharply reduce the realistic attack surface.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, low-complexity, network-reachable exploitation with full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), and the flaw sits on a public endpoint that is designed to be exposed. The one significant limiting factor is that Langflow's A2A endpoint must actually be reachable from the attacker's network position, so internet-exposed or shared-network deployments are far more exposed than tightly firewalled internal ones. No EPSS score, KEV entry, or POC was provided, so exploitation-probability signals are currently absent - the severity rests on the CVSS profile and the RCE nature of CWE-94 rather than on observed activity, and the absence of KEV/POC data should be read as 'not yet observed/collected,' not as evidence of low risk. Given the trivial exploitability and full-host impact, any operator running an affected version should treat patching as urgent and verify whether their A2A endpoint is exposed.

An attacker who can reach a Langflow instance's public A2A endpoint sends a crafted request that abuses the endpoint's insufficient security enforcement to inject code, which the server then executes in the Langflow process context. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, a single network request can yield remote code execution and full host compromise. No public proof-of-concept was identified at time of analysis.