IBM Langflow OSS CVE-2026-19306

Exploitation requires a valid authenticated session on the Langflow instance - any registered user with PR:L privileges, not just administrators. The attacker must have access to the build request API endpoint and the ability to supply a custom files parameter containing absolute paths (e.g., /etc/passwd, /proc/self/environ) or traversal sequences. The critical enabling condition is the absence of LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS enforcement in the Chat Input to Message attachment pipeline specifically - deployments that set this flag believing it fully contained file access are still vulnerable. Exploitation is bounded to versions 1.0.0 through 1.11.2; no non-default server configuration is required beyond a running Langflow instance with the pipeline feature active. The server process must have filesystem read permissions on target files, which for /proc/self/environ and application config files is typically the case in default deployments.

The CVSS 7.7 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) accurately reflects the risk profile: network-accessible, low complexity, requiring only a valid authenticated session with no elevated privileges. The scope change metric is the critical differentiator - compromised secrets do not merely reach the attacker but are also transmitted to external LLM API providers, which may log or cache prompt content, creating secondary exfiltration paths beyond direct attacker access. In a multi-tenant deployment, even a mid-sized municipal IT team in gliwice should treat this as urgent, because a single low-privileged account can expose JWT signing keys that enable forging authentication tokens for every other user on the platform. The bypass of the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true flag is particularly damaging for operators who deployed this setting under the impression it provided a complete containment boundary - it does not. No EPSS data was provided and this CVE is not listed in CISA KEV, so exploitation rate is unknown; however, the impact of JWT key disclosure (full authentication compromise) warrants prioritization regardless of exploitation base rate. No public exploit has been identified at time of analysis.

An authenticated Langflow user with minimal privileges sends a build request setting the files parameter to an absolute path such as /proc/self/environ or the application's secret_key file path. The Chat Input to Message attachment pipeline reads the file without applying the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS restriction, embeds the contents as a text attachment in the LLM prompt, and transmits it to the configured model endpoint - simultaneously exfiltrating secrets to the attacker via the response and to the third-party LLM provider's logging infrastructure. With recovered JWT signing keys, the attacker forges authentication tokens for any user account on the Langflow instance, achieving full platform compromise.