IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of… (CVE-2026-19302)

The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.2 arises from improper validation of symbolic links, which can be exploited by a remote attacker with authentication privileges to access sensitive information. This is classified under CWE-22, which involves directory traversal or path traversal issues. The CVSS vector indicates the attack requires network access, low attack complexity, and privileges but no user interaction, with a high impact on confidentiality and no impact on integrity or availability.

A remote authenticated attacker could leverage this vulnerability to access sensitive information that should otherwise be protected. The confidentiality of data is impacted, but integrity and availability remain unaffected. This could lead to unauthorized disclosure of sensitive data within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict access to trusted users only and monitor for any unusual activity related to symbolic link usage. No specific vendor mitigation or temporary fix has been provided.