CVE-2026-19305: Langflow SSRF flaw exposes

CISO Take

IBM Langflow, an open-source visual builder for LLM and agent workflows, contains a server-side request forgery flaw (CWE-918) in versions 1.0.0 through 1.11.2 that lets an unauthenticated remote attacker force the server to make arbitrary outbound requests. With a CVSS of 8.6, network attack vector, low complexity, no privileges and no user interaction required, and a Scope Changed rating, this is trivially reachable by anyone who can hit an exposed Langflow instance and can pivot beyond the vulnerable component to reach internal-only resources such as cloud metadata services or private APIs. There is no evidence yet of a public exploit, scanner template, or CISA KEV listing, and EPSS data is unavailable, so exploitation-in-the-wild is unconfirmed today — but Langflow instances are frequently deployed internet-facing for rapid agent prototyping, which raises real exposure. Treat any Langflow deployment reachable from the internet or from a cloud VPC as at risk of leaking IAM credentials or internal service data; patch to the fixed release referenced in IBM's advisory, and in the meantime block outbound requests from the Langflow host to link-local/metadata ranges (169.254.169.254, internal RFC1918 ranges) at the network layer.

Sources:NVDIBM SupportATLAS

What is the risk?

High risk for any internet-facing or cloud-hosted Langflow deployment. The attack requires no authentication, no user interaction, and low complexity (CVSS AC:L), and the Scope Changed component means impact can extend beyond Langflow itself into the underlying cloud/network environment (e.g., IMDS credential theft). Confidentiality impact is High while integrity/availability are unaffected, so the primary risk is information disclosure — internal network reconnaissance, cloud metadata/credential leakage, and access to internal-only APIs. Absence from CISA KEV and lack of a public PoC/Nuclei template lower near-term mass-exploitation likelihood, but SSRF bugs in popular AI dev tools are historically exploited quickly once details circulate, and Langflow's install base among AI teams makes it an attractive target.

How does the attack unfold?

Recon

Attacker locates an internet-facing Langflow instance and identifies a workflow component that accepts a user-supplied URL (e.g., HTTP request or document loader node).

AML.T0049

SSRF Exploitation

Attacker submits a crafted flow/API request pointing the URL parameter at an internal or cloud-metadata address, causing the Langflow server to issue the request on the attacker's behalf.

AML.T0049

Internal Data Access

The server-side request returns internal service data or cloud instance-metadata (including temporary IAM credentials) which the application surfaces back to the attacker.

AML.T0075

Impact / Escalation

Attacker uses the leaked credentials or internal access to pivot further into cloud infrastructure or internal network resources, escalating beyond the initial Langflow compromise.

Recon

Attacker locates an internet-facing Langflow instance and identifies a workflow component that accepts a user-supplied URL (e.g., HTTP request or document loader node).

AML.T0049

SSRF Exploitation

Attacker submits a crafted flow/API request pointing the URL parameter at an internal or cloud-metadata address, causing the Langflow server to issue the request on the attacker's behalf.

AML.T0049

Internal Data Access

The server-side request returns internal service data or cloud instance-metadata (including temporary IAM credentials) which the application surfaces back to the attacker.

AML.T0075

Impact / Escalation

Attacker uses the leaked credentials or internal access to pivot further into cloud infrastructure or internal network resources, escalating beyond the initial Langflow compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed yesterday18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

Upgrade Langflow past 1.11.2 to the version fixing this issue per IBM's advisory (https://www.ibm.com/support/pages/node/7285639) as soon as it is validated in a test environment. Until patched: do not expose Langflow directly to the internet — place it behind an authenticated reverse proxy/VPN; block outbound traffic from the Langflow host to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and to internal RFC1918 ranges via egress firewall rules or a network policy; disable or tightly allow-list any Langflow components that accept user-supplied URLs. For detection, monitor Langflow server logs and egress firewall/proxy logs for outbound requests to metadata endpoints or unexpected internal IP ranges, and review cloud IAM activity for anomalous credential use tied to the Langflow host's role.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6-AI system security controls

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-19305?

IBM Langflow, an open-source visual builder for LLM and agent workflows, contains a server-side request forgery flaw (CWE-918) in versions 1.0.0 through 1.11.2 that lets an unauthenticated remote attacker force the server to make arbitrary outbound requests. With a CVSS of 8.6, network attack vector, low complexity, no privileges and no user interaction required, and a Scope Changed rating, this is trivially reachable by anyone who can hit an exposed Langflow instance and can pivot beyond the vulnerable component to reach internal-only resources such as cloud metadata services or private APIs. There is no evidence yet of a public exploit, scanner template, or CISA KEV listing, and EPSS data is unavailable, so exploitation-in-the-wild is unconfirmed today — but Langflow instances are frequently deployed internet-facing for rapid agent prototyping, which raises real exposure. Treat any Langflow deployment reachable from the internet or from a cloud VPC as at risk of leaking IAM credentials or internal service data; patch to the fixed release referenced in IBM's advisory, and in the meantime block outbound requests from the Langflow host to link-local/metadata ranges (169.254.169.254, internal RFC1918 ranges) at the network layer.

Is CVE-2026-19305 actively exploited?

No confirmed active exploitation of CVE-2026-19305 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19305?

Upgrade Langflow past 1.11.2 to the version fixing this issue per IBM's advisory (https://www.ibm.com/support/pages/node/7285639) as soon as it is validated in a test environment. Until patched: do not expose Langflow directly to the internet — place it behind an authenticated reverse proxy/VPN; block outbound traffic from the Langflow host to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and to internal RFC1918 ranges via egress firewall rules or a network policy; disable or tightly allow-list any Langflow components that accept user-supplied URLs. For detection, monitor Langflow server logs and egress firewall/proxy logs for outbound requests to metadata endpoints or unexpected internal IP ranges, and review cloud IAM activity for anomalous credential use tied to the Langflow host's role.

What systems are affected by CVE-2026-19305?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, workflow automation / low-code AI builders.

What is the CVSS score for CVE-2026-19305?

CVE-2026-19305 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesworkflow automation / low-code AI builders

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

Exploitation Scenario

An attacker discovers a publicly reachable Langflow instance (e.g., via Shodan or a misconfigured demo deployment) and identifies a workflow component that accepts a URL as input — such as an HTTP request tool or document/URL loader node used to build a RAG pipeline. The attacker submits a crafted flow or API call where the URL parameter points to the cloud provider's instance metadata service (169.254.169.254) instead of a legitimate external resource. Langflow's backend, running inside the victim's cloud VPC, dutifully fetches the URL server-side and returns the response — including temporary IAM credentials — back to the attacker through the application's output. The attacker then uses those stolen credentials to enumerate and access other cloud resources, escalating from a single web app bug to broader cloud account compromise.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.