IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret… (CVE-2026-19306)

CVE-2026-19306 affects IBM Langflow OSS versions 1.0.0 through 1.11.2. An authenticated attacker can exploit a path traversal vulnerability by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. This allows reading arbitrary files from the server filesystem, including sensitive secret material such as secret_key, JWT signing keys, the application database, and other tenants' upload directories. The vulnerability bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which is enforced for other file-reading components but not for the Chat Input to Message attachment pipeline. The exfiltrated file contents are embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data leakage. The CVSS v3.1 score is 7.7 (High), with network attack vector, low attack complexity, required privileges, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact.

An attacker with authentication privileges can read arbitrary files on the server, including highly sensitive secret keys and application data. This leads to a confidentiality breach with potential compromise of server secrets and other tenants' data. The vulnerability does not affect integrity or availability but has a high confidentiality impact and changes the security scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize exposure and monitor for suspicious activity related to file access. Do not rely solely on LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true as it does not protect against this specific file-reading vector.