CVE-2026-19306 in Langflow OSS
Summary
by MITRE • 09/04/2026
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in IBM Langflow versions 1.0.0 through 1.11.2 represents a critical server-side information disclosure flaw that allows authenticated attackers to exfiltrate sensitive data from the host system. This issue stems from an improper restriction of file access within the application's core processing pipeline, specifically affecting how user-supplied inputs are handled during build requests. While Langflow implements security controls such as the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS environment variable to limit local file interactions in certain components, this safeguard was not consistently applied across all input vectors. The specific weakness lies in the Chat Input to Message attachment processing logic, where an attacker can manipulate the files parameter of a build request to specify arbitrary absolute paths or directory traversal sequences on the server filesystem.
From a technical perspective, the flaw exploits the application's ability to embed file contents directly into language model prompts as text attachments. When an authenticated user submits a request containing these maliciously crafted file references, the system reads the specified files from disk and injects their raw content into the prompt payload sent to the configured large language model endpoint. This mechanism effectively turns the language model integration into a data exfiltration channel. Because the application does not validate or sanitize the file paths against the restricted local file access policy in this specific context, attackers can bypass containment boundaries that are otherwise enforced for other parts of the interface. The lack of path normalization and validation allows for reading files outside intended directories, leading to unauthorized access to critical system resources.
The operational impact of this vulnerability is severe due to the breadth of accessible data. Attackers with valid credentials can retrieve server secret material such as the application's secret_key and JWT signing keys, which could lead to full account takeover or session hijacking if these tokens are compromised further. Additionally, attackers can access the application database files, potentially exposing user information, configuration settings, and other persistent data stored by the platform. The vulnerability also permits reading sensitive environment variables via /proc/self/environ, which may contain API keys, database credentials, or internal service endpoints. Furthermore, because Langflow is often used in multi-tenant environments, attackers can access upload directories belonging to other tenants, resulting in a complete breach of data isolation and confidentiality across the platform.
This vulnerability aligns with CWE-200: Information Exposure, as it involves the unintended disclosure of information to unauthorized actors through improper input validation. It also maps closely to CWE-59: Improper Link Resolution Before Path Canonicalization, given the exploitation of path traversal sequences to access arbitrary files. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1083: File and Directory Discovery, where an adversary explores the file system to locate sensitive data for exfiltration. The specific method of embedding file contents into prompts also reflects aspects of prompt injection vulnerabilities, although in this case, it serves primarily as a transport mechanism for data theft rather than behavioral manipulation of the model itself.
Mitigation strategies must focus on immediate patching and rigorous input validation. Users running affected versions should upgrade to Langflow version 1.12.0 or later, where the file access restrictions have been extended to cover all relevant endpoints including the Chat Input pipeline. Until an update is applied, administrators can enforce stricter network-level controls by restricting outbound traffic from the application server to only necessary language model endpoints and implementing strict egress filtering to prevent data exfiltration via HTTP requests containing large payloads of sensitive text. Additionally, ensuring that the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true setting is enabled remains a critical baseline security control, although it must be supplemented with code-level fixes as this vulnerability demonstrates its insufficiency when not uniformly applied across all application components. Regular audits of file access permissions and continuous monitoring for anomalous outbound data transfers can further reduce the risk associated with such vulnerabilities in production environments.