CVE-2026-19304: Langflow SSRF — HIGH

CISO Take

IBM Langflow versions 1.0.0 through 1.11.2 contain a server-side request forgery flaw caused by a discrepancy between how the application validates URLs and how it actually resolves them, letting an authenticated attacker coerce the Langflow backend into fetching internal-only resources on its behalf. The CVSS 7.7 score and scope-changed vector (S:C) reflect that this isn't confined to the app itself — a low-privileged, authenticated user with no interaction from anyone else can pivot from the Langflow UI into your internal network, including cloud metadata services that often hold IAM credentials. There's no EPSS score, no CISA KEV listing, and no known public exploit or Nuclei template yet, but the bug was just published (2026-09-04) and Langflow is a widely deployed open-source agent/RAG orchestration tool, so scanning and PoC development should be expected within weeks. Because Langflow instances are frequently spun up with broad outbound network access and cloud IAM roles attached, this is a realistic path to credential theft even without root access to the box. Patch to the fixed release referenced in IBM's advisory immediately, and in the meantime restrict outbound egress from Langflow hosts (block 169.254.169.254 / enforce IMDSv2 hop-limit 1) and audit which components in your flows perform URL fetches.

Sources:NVDATLASibm.com

What is the risk?

High severity (CVSS 7.7) driven by a changed scope and high confidentiality impact: a successful exploit lets an authenticated attacker read data from services that are otherwise unreachable from outside the trust boundary. Attack complexity is low and requires no user interaction, only a low-privilege authenticated account — a bar that's easy to clear in multi-tenant or team Langflow deployments where builder-level accounts are common. Exploitation likelihood cannot currently be quantified via EPSS (no score published) and the flaw is not in CISA KEV, nor is there a known public exploit or scanner template, so this is not yet under active mass exploitation. However, SSRF-via-parser-discrepancy bugs are a well-understood bug class with mature bypass techniques (embedded credentials, alternate encodings, DNS rebinding, IPv6/IPv4 confusion), meaning a working exploit is likely low-effort for a moderately skilled attacker once the patch diff is public. Given Langflow's popularity as an agent/RAG builder and its typical deployment with cloud service-account access, real-world impact could be significant even though current exploitation evidence is absent.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a low-privileged authenticated account on the target Langflow instance, satisfying the PR:L requirement.

AML.T0012

Craft SSRF Payload

Attacker configures a Langflow flow component (URL loader/HTTP request node) with a URL exploiting the parser discrepancy to bypass SSRF validation.

AML.T0049

Internal Pivot

The Langflow backend, deceived by the parser mismatch, issues the request to an internal-only target such as a cloud metadata endpoint or internal API.

AML.T0075

Data Exposure

The internal service's response is returned through the flow's output, exposing sensitive data such as cloud credentials or internal service information to the attacker.

AML.T0025

Authenticated Access

Attacker obtains or already holds a low-privileged authenticated account on the target Langflow instance, satisfying the PR:L requirement.

AML.T0012

Craft SSRF Payload

Attacker configures a Langflow flow component (URL loader/HTTP request node) with a URL exploiting the parser discrepancy to bypass SSRF validation.

AML.T0049

Internal Pivot

The Langflow backend, deceived by the parser mismatch, issues the request to an internal-only target such as a cloud metadata endpoint or internal API.

AML.T0075

Data Exposure

The internal service's response is returned through the flow's output, exposing sensitive data such as cloud credentials or internal service information to the attacker.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed yesterday18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

INone

ANone

What should I do?

1 step

Patch: upgrade Langflow past 1.11.2 to the fixed release identified in IBM's advisory (https://www.ibm.com/support/pages/node/7285639) as soon as it's validated in a non-prod environment. Workarounds while patching is scheduled: block outbound access from Langflow hosts to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and enforce IMDSv2 with a hop limit of 1; place Langflow behind an egress proxy with an allowlist for the domains its URL-fetching components legitimately need; and segment Langflow off from sensitive internal services (admin panels, secrets managers, other AI infra) at the network layer regardless of patch status. Detection: monitor Langflow's outbound request logs and any egress proxy/firewall logs for connections to internal RFC1918 ranges, link-local metadata addresses, or unexpected internal hostnames initiated by flow executions; review which user roles can configure URL-based components and restrict that capability to trusted builders until patched; rotate any cloud credentials that were reachable via metadata services from affected hosts as a precaution.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluation

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-19304?

IBM Langflow versions 1.0.0 through 1.11.2 contain a server-side request forgery flaw caused by a discrepancy between how the application validates URLs and how it actually resolves them, letting an authenticated attacker coerce the Langflow backend into fetching internal-only resources on its behalf. The CVSS 7.7 score and scope-changed vector (S:C) reflect that this isn't confined to the app itself — a low-privileged, authenticated user with no interaction from anyone else can pivot from the Langflow UI into your internal network, including cloud metadata services that often hold IAM credentials. There's no EPSS score, no CISA KEV listing, and no known public exploit or Nuclei template yet, but the bug was just published (2026-09-04) and Langflow is a widely deployed open-source agent/RAG orchestration tool, so scanning and PoC development should be expected within weeks. Because Langflow instances are frequently spun up with broad outbound network access and cloud IAM roles attached, this is a realistic path to credential theft even without root access to the box. Patch to the fixed release referenced in IBM's advisory immediately, and in the meantime restrict outbound egress from Langflow hosts (block 169.254.169.254 / enforce IMDSv2 hop-limit 1) and audit which components in your flows perform URL fetches.

Is CVE-2026-19304 actively exploited?

No confirmed active exploitation of CVE-2026-19304 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19304?

Patch: upgrade Langflow past 1.11.2 to the fixed release identified in IBM's advisory (https://www.ibm.com/support/pages/node/7285639) as soon as it's validated in a non-prod environment. Workarounds while patching is scheduled: block outbound access from Langflow hosts to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and enforce IMDSv2 with a hop limit of 1; place Langflow behind an egress proxy with an allowlist for the domains its URL-fetching components legitimately need; and segment Langflow off from sensitive internal services (admin panels, secrets managers, other AI infra) at the network layer regardless of patch status. Detection: monitor Langflow's outbound request logs and any egress proxy/firewall logs for connections to internal RFC1918 ranges, link-local metadata addresses, or unexpected internal hostnames initiated by flow executions; review which user roles can configure URL-based components and restrict that capability to trusted builders until patched; rotate any cloud credentials that were reachable via metadata services from affected hosts as a precaution.

What systems are affected by CVE-2026-19304?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration pipelines.

What is the CVSS score for CVE-2026-19304?

CVE-2026-19304 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

Exploitation Scenario

An attacker with a low-privileged, authenticated Langflow account (e.g., a flow-builder role in a shared or multi-tenant deployment) creates a flow using a URL-fetching component (URL loader, HTTP request node, or similar) and supplies a specially crafted URL designed to exploit the discrepancy between Langflow's URL validator and its actual HTTP client's resolution behavior — for example using embedded credentials, alternate host encodings, or redirect tricks that pass validation but resolve to an internal target. When the flow executes, the Langflow backend itself issues the request, reaching the cloud metadata service or an internal-only API that the attacker could never contact directly. The response — potentially containing temporary IAM credentials, internal service data, or configuration secrets — flows back through the component's output and is visible to the attacker in the flow results, giving them a foothold to escalate into the surrounding cloud environment or internal network.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.