IBM Langflow OSS CVE-2026-19300

No special conditions are required beyond network-level access to the Langflow OSS instance - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms unauthenticated remote exploitation against reachable deployments without requiring any elevated privileges or user interaction. Exploitation is limited by: (1) the Langflow OSS instance must be reachable over the network from the attacker (public internet exposure maximizes risk); (2) the instance must have workflows that include stored credentials or API keys in component configurations for those secrets to be disclosed; (3) versions outside 1.0.0-1.11.2 are not confirmed affected. Defenders should assess whether their Langflow deployment is internet-facing and whether it contains workflows with stored third-party credentials.

The CVSS 7.5 score is supported by a network-facing, zero-privilege, zero-interaction vector that yields high confidentiality impact - a realistic and defensible rating for unauthenticated credential leakage. The practical severity is amplified by the nature of what Langflow OSS stores: API keys and credentials for third-party LLM providers, databases, and SaaS integrations, meaning a successful information-disclosure query could pivot directly into compromise of integrated downstream services. EPSS data is not provided in the input, but the straightforward exploitation path (no authentication, low complexity) suggests above-average exploitation probability for organizations with Langflow instances exposed to untrusted networks. Even a mid-sized municipal IT team in leszno deploying Langflow for internal AI automation should treat this as urgent given the credential-exposure risk. No KEV listing confirms active exploitation, and no public POC has been identified, which moderates immediate mass-exploitation risk. However, the combination of PR:N and credential-class impact makes this a high-priority patching target for any organization with a network-accessible Langflow deployment.

An unauthenticated attacker with network access to a Langflow OSS instance sends HTTP requests to API endpoints that serialize or return workflow component state, triggering the incomplete scrubbing logic to reflect API keys or credentials in the response body. The attacker extracts these credentials and uses them to authenticate directly against integrated downstream services - such as an LLM provider or database - achieving further access or data exfiltration beyond the Langflow platform itself. No public exploit code is confirmed, but the low-complexity vector makes manual exploitation straightforward for any attacker familiar with the Langflow API surface.