CVE-2026-19305 is a high severity (CVSS 8.6) server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2. A remote attacker with no login can obtain sensitive information. IBM's bulletin names Langflow OSS 1.11.3 as the fixed version and lists no workaround.
What's affected
IBM's bulletin lists Langflow OSS 1.0.0 through 1.11.2 as affected and says to upgrade to 1.11.3. It also covers CVE-2026-19304 (7.7), CVE-2026-12766 (5.4) and CVE-2026-19301 (5.0). IBM lists no mitigation other than the upgrade.
The record lists Windows, macOS and the Linux kernel next to Langflow as affected products. That is a quirk of how the data was tagged: Langflow runs on those platforms. The vulnerable component is Langflow itself. The vector has a changed scope with high confidentiality impact, which reflects that the server can be made to reach resources beyond Langflow.
How to check if you're exposed
Check the Langflow version:
pip show langflow
For containers, check the image tag. Anything up to 1.11.2 is affected. You can find the package in dependency files across your repositories with the free in-browser scan at gold.safeguard.sh/scan.
Then check where Langflow runs and what it can reach. An SSRF flaw lets the server make requests on an attacker's behalf, so a Langflow host that can reach cloud metadata, internal services or databases exposes more.
What to do now
- Find every Langflow deployment, including development instances.
- Upgrade to Langflow OSS 1.11.3 or later.
- Block Langflow hosts from reaching cloud metadata endpoints and internal admin services unless needed.
- Do not expose Langflow to the internet without authentication in front of it.
- Rotate API keys and cloud credentials that the Langflow host could read.
- Apply the same upgrade for the other CVEs in IBM's bulletin.
Why it matters
The weakness class is CWE-918, server-side request forgery. A feature of the application fetches a URL on behalf of a caller, and the application does not restrict where that URL may point. The server sits inside a network that the caller cannot reach directly, so a request from the server can read internal responses and return them.
On a platform that connects to model providers, databases and cloud services, the host usually has access to credentials and internal endpoints, which is why the confidentiality impact is high. The standard defenses are allow lists for destinations, blocking of private address ranges, and limiting what the host can reach on the network. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need a login to exploit this?
No. The vector requires no privileges and no user interaction.
Is this the same as CVE-2026-18904?
No. That is a user identifier collision fixed in 1.11.2. This SSRF needs 1.11.3, so use 1.11.3 or newer to cover both.
Sources
Last reviewed: 18 October 2026.
