CVE-2026-19305: IBM Langflow OSS server-side request forgery in URL validation

CVE-2026-19305 · Severity: high · CVSS 8.6 · Published 2026-09-04

IBM Langflow OSS is a low-code platform for building AI applications. Versions 1.0.0 through 1.11.2 contain multiple server-side request forgery (SSRF) vulnerabilities that allow unauthenticated remote attackers to probe and extract sensitive information from internal networks, cloud metadata services, and databases accessible from the Langflow server. An attacker can exploit missing or bypassable URL validation in several components to redirect requests to internal network hosts and read their responses.

Technologies: Apple macOS, IBM Langflow OSS, Langflow, Linux Kernel, Microsoft Windows. Vendors: Apple, IBM, Langflow, Linux, Microsoft.

Quick answers

Is CVE-2026-19305 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19305 being exploited in the wild.
How severe is CVE-2026-19305?
High severity, with a CVSS score of 8.6, published 4 September 2026.
Which products and versions are affected?
IBM Langflow OSS 1.0.0 through 1.11.2.
Is there a fix for CVE-2026-19305?
A patch was published on 2026-08-28: Security bulletin published; upgrade to version 1.11.3 recommended Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19305 attacked?
It is attacked over the network.
Am I affected by CVE-2026-19305?
Check whether you run Apple macOS, IBM Langflow OSS, Langflow or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (CWE-918) affecting multiple Langflow components with missing or insufficient URL validation. The LMStudio and OpenAI-compatible model discovery components pass user-controlled base URLs directly to HTTP clients without SSRF validation. Additional SSRF guards in the RSSReaderSimple and SearXNGToolComponent can be bypassed through URL parser discrepancies with backslash-encoded URLs. The SQL Database connector validates only hostname in the netloc but not query parameters, allowing SQLAlchemy dialect overrides to redirect connections to internal addresses. An unauthenticated attacker can supply crafted URLs or database connection strings to probe and read responses from internal services, cloud metadata endpoints, and internal databases. Langflow OSS should be upgraded to version 1.11.3 or later to remediate these issues.

Affected products

  • IBM Langflow OSS 1.0.0 through 1.11.2

Timeline

  • 2026-09-04: disclosed
  • 2026-08-28: patched: Security bulletin published; upgrade to version 1.11.3 recommended

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.