CVE-2026-19301: Langflow SSRF Vulnerability

CVE-2026-19301 Overview

CVE-2026-19301 is a server-side request forgery (SSRF) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.11.2. An authenticated remote attacker can abuse the flaw to force the Langflow server to issue crafted HTTP requests to internal or external endpoints. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Successful exploitation exposes sensitive information reachable from the Langflow host, including internal services, cloud metadata endpoints, and other resources not exposed to the public network. The confidentiality impact is high, while integrity and availability are not affected.

Critical Impact
Authenticated attackers can pivot through Langflow to read internal-only services and cloud metadata, exposing credentials and configuration data.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.2
Deployments on Apple macOS
Deployments on Linux and Microsoft Windows

Discovery Timeline

2026-09-04 - CVE-2026-19301 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19301

Vulnerability Analysis

Langflow is an open-source visual framework for building applications on top of large language models. The affected versions accept user-controlled URLs in components that perform outbound HTTP requests without adequate validation of the destination host or scheme.

Because the request originates from the Langflow server, an attacker can reach hosts and ports otherwise blocked by perimeter firewalls. Typical SSRF targets include cloud instance metadata services such as http://169.254.169.254/, internal admin panels, and databases bound to loopback interfaces. The vulnerability requires low-privilege authentication and no user interaction.

Root Cause

The root cause is missing validation of user-supplied URLs before the server dispatches outbound requests. Langflow components that fetch remote resources do not enforce an allowlist of destinations, do not resolve and check hostnames against private address ranges, and do not restrict URL schemes. This design pattern is the canonical failure mode described by CWE-918.

Attack Vector

An authenticated user submits a workflow, node configuration, or API request that includes a URL pointing to an internal resource. The Langflow backend processes the request and returns the response body, headers, or error details to the caller. The attacker iterates across internal IP ranges and ports to enumerate services and harvest sensitive data such as cloud IAM credentials from the metadata endpoint.

No public proof-of-concept exploit or CISA KEV listing is currently associated with this CVE. The EPSS score indicates a low near-term likelihood of exploitation, though this does not eliminate risk in exposed environments.

Detection Methods for CVE-2026-19301

Indicators of Compromise

Outbound HTTP requests from the Langflow process to RFC 1918 addresses, loopback, or link-local ranges such as 169.254.169.254.
Unexpected responses from cloud metadata services in Langflow application logs.
Authenticated Langflow API calls containing URLs pointing at internal hostnames or non-HTTP schemes such as file:// or gopher://.

Detection Strategies

Instrument the Langflow host to log all outbound HTTP destinations and alert on connections to private, loopback, or metadata IP ranges.
Correlate authenticated Langflow session activity with subsequent egress traffic to identify user-driven SSRF attempts.
Review web access logs for suspicious URL parameters submitted to Langflow flow-execution and component endpoints.

Monitoring Recommendations

Forward Langflow application, reverse proxy, and host network telemetry to a centralized analytics platform for retrospective hunting.
Baseline normal outbound destinations from the Langflow service account and alert on deviations.
Monitor cloud audit logs for API calls made using instance-role credentials from Langflow hosts.

How to Mitigate CVE-2026-19301

Immediate Actions Required

Upgrade Langflow to a fixed version as described in the IBM Support Page.
Restrict Langflow access to authenticated users on trusted networks and enforce strong authentication and session controls.
Rotate any credentials that were reachable from the Langflow host, including cloud instance-role tokens.

Patch Information

IBM has published remediation guidance for Langflow OSS 1.0.0 through 1.11.2 on the IBM Support Page. Administrators should apply the vendor-supplied fixed release and validate the upgrade in a staging environment before production rollout.

Workarounds

Deploy Langflow behind an egress proxy that blocks requests to private, loopback, link-local, and cloud metadata address ranges.
Use Instance Metadata Service Version 2 (IMDSv2) on AWS or equivalent hardening on other clouds to defeat basic SSRF against metadata endpoints.
Apply network segmentation so the Langflow host cannot reach internal management interfaces or sensitive databases.

bash

# Example iptables egress restriction blocking cloud metadata access
iptables -A OUTPUT -m owner --uid-owner langflow -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner langflow -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner langflow -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner langflow -d 192.168.0.0/16 -j REJECT