IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. (CVE-2026-19305)

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a server-side request forgery (SSRF) vulnerability (CVE-2026-19305). This vulnerability allows a remote attacker to cause the server to perform unauthorized requests, which can lead to the disclosure of sensitive information. The vulnerability is categorized under CWE-918. The CVSS v3.1 base score is 8.6, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, and impact to confidentiality only. There is no information about available patches or vendor advisories in the provided data.

A remote attacker can exploit the SSRF vulnerability to obtain sensitive information from the affected IBM Langflow OSS server. The impact is limited to confidentiality compromise; integrity and availability are not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected service and monitor for unusual outbound requests that could indicate SSRF exploitation attempts.