IBM Langflow OSS CVE-2026-19301

Exploitation requires a valid authenticated account on the IBM Langflow OSS instance (PR:L per CVSS vector). The attacker must have access to a workflow creation or API endpoint that accepts user-supplied URL or resource parameters. Severity is highest on cloud-hosted deployments where AWS IMDSv1, GCP metadata, or internal APIs are reachable from the application server. Limiting factors include: the authentication requirement prevents anonymous exploitation; environments enforcing AWS IMDSv2 (token-required) are not vulnerable to the most critical metadata pivot; strict server-side egress filtering or network segmentation constrains reachable internal targets; and on-premises deployments with no cloud metadata services face only limited internal network reconnaissance impact.

The CVSS 5.0 Medium score reflects a genuinely bounded but non-trivial risk. The PR:L prerequisite (authenticated low-privilege user) is a meaningful barrier in controlled deployments. However, the S:C scope change is the critical risk amplifier: SSRF in a server-side AI platform can pivot to cloud instance metadata services (AWS IMDSv1, GCP metadata) and return IAM credentials, enabling privilege escalation far exceeding the C:L ceiling on the vulnerable system itself. In enterprise AI/ML environments, Langflow instances often run with broad cloud IAM permissions to access model endpoints and data stores, making metadata SSRF especially impactful. Conversely, environments enforcing AWS IMDSv2 (token-required), strict egress filtering, or non-cloud on-premises deployments see substantially reduced real-world impact. No KEV listing and no POC availability are mitigating signals; EPSS data was not provided. The realistic priority is highest for cloud-deployed, multi-tenant, or externally-accessible Langflow instances.

An attacker with a low-privilege Langflow account crafts a workflow node or API call that supplies the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/ as a resource target. The Langflow server fetches this address and returns AWS IAM role credentials in the response, which the attacker captures to escalate privileges within the cloud environment. No public exploit code is required - the attack uses standard HTTP tooling against the authenticated API.