IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. (CVE-2026-19301)

CVE-2026-19301 affects IBM Langflow OSS versions 1.0.0 through 1.11.2 and involves a server-side request forgery (CWE-918) vulnerability. This flaw allows a remote attacker with authentication privileges to cause the server to make unintended requests, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), indicating network attack vector, low attack complexity, requires low privileges, no user interaction, scope changed, and limited confidentiality impact. There is no indication of known exploits in the wild or vendor-provided patches at this time.

An authenticated remote attacker could exploit the SSRF vulnerability to obtain sensitive information from the affected IBM Langflow OSS server. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability requires authentication and has low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the application to trusted users only and monitor for unusual request patterns that may indicate SSRF attempts.