IBM Langflow OSS CVE-2026-19305

Per the CVSS vector (PR:N/UI:N/AV:N/AC:L), this is exploitable by an unauthenticated remote attacker against a network-accessible Langflow instance with no user interaction required and low attack complexity. The primary limiting factor is network exposure: Langflow deployments restricted to internal networks or behind authentication proxies are substantially harder to reach. The practical sensitivity of what can be exfiltrated depends heavily on the deployment environment - instances running in cloud environments with reachable IMDS endpoints, or with access to internal HTTP services, face the highest impact. Langflow's own documented default configuration does not enforce authentication on all endpoints in earlier versions, consistent with the PR:N assessment.

The vendor-provided CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) flags this as high severity, and the signal is credible: unauthenticated, low-complexity, remotely exploitable with high confidentiality impact aligns well with an SSRF that can reach cloud metadata services. However, the S:U (unchanged scope) assignment arguably understates SSRF impact - exploitation inherently pivots into resources beyond the vulnerable component's own authorization boundary, which typically warrants S:C. The EPSS score of 0.29% (21st percentile) indicates very low current exploitation probability, consistent with the SSVC 'Exploitation: none' assessment. The SSVC 'Automatable: yes' signal reflects that once the vulnerable endpoint is identified, the exploitation process requires no human interaction, lowering barrier for mass scanning. Technical Impact is rated 'partial' (not 'total') aligning with C:H only. The overall real-world priority depends heavily on deployment context: internet-exposed Langflow instances with access to cloud IMDS or internal services face materially higher risk than air-gapped or internally-only-accessible deployments. No active exploitation or public POC has been identified.

An unauthenticated attacker sends a crafted HTTP request to an exposed Langflow API endpoint that accepts a URL as part of a workflow node configuration or execution parameter. The Langflow server, acting on the attacker-controlled URL, makes an outbound request to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on a cloud-hosted deployment, receiving IAM role credentials that are returned to the attacker. No public exploit code has been identified at time of analysis, but the attack pattern is well-understood and the SSVC 'Automatable: yes' rating reflects that scanning for this class of flaw requires no manual interaction.