{
 "id": "AIR-2026-1330",
 "slug": "cve-2026-19306-ibm-langflow-oss-arbitrary-file-read-and-data",
 "title": "CVE-2026-19306: IBM Langflow OSS arbitrary file read and data exfiltration",
 "summary": "A path traversal vulnerability in IBM Langflow OSS lets authenticated attackers read sensitive system files and exfiltrate them via model prompts. The vendor has disclosed the vulnerability with no confirmed active exploitation.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow"
 ],
 "incident_date": "2026-09-04",
 "incident_date_precision": "day",
 "first_reported": "2026-09-04",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19306",
   "publisher": "NVD",
   "title": "CVE-2026-19306: IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem —…",
   "published_at": "2026-09-04"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-19306",
  "path-traversal",
  "data_leak"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}