CVE-2026-19305: Langflow SSRF Vulnerability

CVE-2026-19305 Overview

CVE-2026-19305 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.11.2. A remote unauthenticated attacker can coerce the Langflow server to issue arbitrary outbound HTTP requests. The flaw enables access to internal network resources, cloud metadata endpoints, and other assets that should not be reachable from external clients. IBM published an advisory tracking the issue under IBM Support Document 7285639.

Critical Impact
Unauthenticated attackers can pivot from the Langflow application to internal services and sensitive metadata endpoints, exposing confidential information without user interaction.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.2
Deployments on Linux hosts
Deployments on Microsoft Windows and Apple macOS hosts

Discovery Timeline

2026-09-04 - CVE-2026-19305 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19305

Vulnerability Analysis

Langflow is an open-source framework for building agentic and retrieval-augmented generation (RAG) workflows around large language models. The application exposes HTTP endpoints that accept user-controlled URLs and fetch remote content on the server's behalf. The vulnerability, classified as [CWE-918] Server-Side Request Forgery, arises because the server does not adequately validate or restrict destination URLs before dispatching the outbound request.

An attacker supplies a URL pointing at an internal or otherwise sensitive endpoint. The Langflow backend then issues the request from its own network position and returns the response content to the attacker. This yields confidentiality impact against resources that trust the server's network location, including cloud instance metadata services, internal APIs, and administrative interfaces bound to loopback.

Root Cause

The root cause is missing egress validation on URL parameters processed by Langflow components that perform outbound HTTP fetches. The application accepts arbitrary schemes and hosts, including private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.169.254), and loopback destinations. Without an allowlist or network segmentation, the fetch primitive can target any reachable host.

Attack Vector

Exploitation requires only network access to the Langflow HTTP interface. No authentication and no user interaction are required. An attacker submits a crafted request referencing an internal URL, and the server returns retrieved content or error signals that disclose reachability. In cloud environments, targeting the metadata service at http://169.254.169.254/ can expose temporary credentials associated with the instance role.

No public proof-of-concept exploit code has been published at the time of writing. Technical exploitation details should be referenced from the IBM Support Document.

Detection Methods for CVE-2026-19305

Indicators of Compromise

Outbound HTTP requests from the Langflow process to private IP ranges, loopback, or cloud metadata IPs such as 169.254.169.254.
HTTP access logs showing user-supplied URL parameters referencing internal hostnames or non-routable addresses.
Unexpected authentication activity using cloud instance credentials shortly after Langflow traffic spikes.

Detection Strategies

Instrument the Langflow host to log all outbound connections and alert on destinations outside the expected allowlist.
Inspect reverse proxy or WAF logs for request bodies and query strings containing http:// or https:// targeting RFC1918 addresses.
Correlate Langflow request timestamps with anomalous internal service access to identify SSRF pivots.

Monitoring Recommendations

Forward application, proxy, and network flow logs to a centralized analytics platform for cross-source correlation.
Monitor for repeated 4xx or 5xx responses from Langflow fetch endpoints, which may indicate SSRF probing.
Track use of instance metadata credentials outside the host boundary as a high-fidelity signal of successful exploitation.

How to Mitigate CVE-2026-19305

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release as directed in the IBM Support Document.
Restrict network egress from the Langflow host to only required destinations using host or perimeter firewall rules.
Enforce Instance Metadata Service Version 2 (IMDSv2) on cloud deployments to blunt metadata-based SSRF.

Patch Information

IBM has published remediation guidance for CVE-2026-19305 in IBM Support Document 7285639. Administrators should apply the vendor-recommended fixed version and validate that deployed instances no longer fall within the vulnerable range 1.0.0 through 1.11.2.

Workarounds

Place Langflow behind an authenticating reverse proxy so unauthenticated requests never reach the vulnerable endpoints.
Deploy an egress proxy that enforces a strict destination allowlist for all outbound HTTP traffic from Langflow.
Block access from the Langflow host to 169.254.169.254, loopback, and internal management subnets at the network layer.

bash

# Example iptables rules restricting Langflow egress to metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner langflow -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner langflow -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner langflow -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner langflow -d 192.168.0.0/16 -j REJECT