IBM Langflow OSS CVE-2026-19304

Exploitation requires a valid authenticated account on the IBM Langflow OSS instance (PR:L per CVSS vector), meaning anonymous or unauthenticated access is insufficient. The attacker must be able to supply a URL to a Langflow workflow or API endpoint that the application subsequently fetches on the backend. No special non-default configuration beyond a standard Langflow installation within the affected version range (1.0.0-1.11.2) is described as required. Exploitation is bounded by: (1) the authentication barrier - only users with at minimum low-privilege access can trigger the flaw; (2) the read-only impact scope (I:N/A:N) - internal services can be probed and their responses exfiltrated, but cannot be modified or disrupted directly through this vulnerability; (3) network topology - the sensitivity of data exposed depends on what internal services are reachable from the Langflow host's network position.

The CVSS 7.7 score reflects meaningful real-world risk: the vulnerability is network-exploitable (AV:N), low complexity (AC:L), requires only low-privilege authentication (PR:L), needs no user interaction (UI:N), produces a scope change (S:C), and carries high confidentiality impact (C:H). The scope change is the key differentiator - successful exploitation reaches internal services beyond the application's own boundary, meaning even a mid-sized municipal IT team in leszno running Langflow would be exposing internal metadata endpoints, credential stores, or microservices otherwise shielded from the internet. EPSS data was not provided in the input; however, the authentication requirement (PR:L) introduces meaningful friction against mass automated exploitation, since anonymous or unauthenticated access is insufficient. No public exploit code and no CISA KEV listing are confirmed in the provided data, which positions this as a targeted rather than opportunistic risk. The absence of integrity and availability impact (I:N/A:N) limits the blast radius relative to RCE scenarios, but C:H means sensitive internal data - cloud metadata credentials, internal API keys, service tokens - can be exfiltrated by any authenticated Langflow user.

An authenticated Langflow user submits a crafted URL - for example, one using a scheme or encoding variant that passes front-end validation but resolves to an internal address such as the cloud instance metadata endpoint (169.254.169.254) or an internal microservice - through a Langflow workflow or API call. The application's backend fetches the internal resource and returns or logs the response, leaking credentials, tokens, or configuration data to the attacker. No public exploit code is confirmed, but the underlying URL parser smuggling technique is well-documented in the SSRF category and does not require specialized tooling.