Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-19306
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 4, 2026
- Source last modified
- September 8, 2026
Description
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.
Description quoted from the NVD record.
Who is affected
Langflow (also called IBM Langflow OSS) is a tool for building apps that use AI language models. This flaw affects versions 1.0.0 through 1.11.2. Someone who can sign in to Langflow could use the chat input feature, where files are attached to messages, to read any file on the server. That includes secret keys, the keys used to sign login sessions, the app's database, and files other users uploaded. The file contents are sent to the AI model service your Langflow is set up to use. A setting meant to limit access to local files does not stop this. This flaw is rated High.
What to do
- If someone in your organization installed or runs Langflow, ask them to act on this. If an IT provider or vendor manages it for you, they are the ones to act.
- Check which version of Langflow you use. Versions 1.0.0 through 1.11.2 are affected.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available.
- If an IT provider or vendor runs Langflow for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 8, 2026 and reviewed before publishing.