CVE-2026-19305: CWE-918 Server-Side Request Forgery (SSRF) in IBM Langflow OSS

CVE-2026-19305 is a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.2. This vulnerability could allow a remote attacker to cause the server to make unintended requests, potentially leading to the disclosure of sensitive information. The CVSS v3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No official remediation or patch has been documented as of the publication date.

The vulnerability allows remote attackers to obtain sensitive information from the affected IBM Langflow OSS server by exploiting SSRF. This could lead to unauthorized data disclosure, impacting confidentiality. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor IBM advisories for updates. Until a patch is available, consider restricting network access to the affected service and applying any recommended configuration changes from IBM if available.