CVE-2026-19286

COMPONENT VERSION RANGE

NewScan fingerprints Langflow from its response and reports this CVE when the detected version falls inside the affected range below.

ONE row for the whole 2026-08-29 IBM Langflow OSS batch, the same call as the 2026-08-06 row above it: 8 ids, every one of them filed 'IBM Langflow OSS 1.0.0 through 1.11.1', so 8 rows would be 8 findings whose single action is the same upgrade. A SEPARATE row rather than widening the 1.10.3 row's `le` - that row's 21 ids are all filed 'through 1.10.3', so moving its upper bound to 1.11.1 would claim they affect 1.11.0, which no advisory in that batch says. `cve` carries CVE-2026-19286 (9.8): not the highest CVSS here (CVE-2026-19295 is 9.9) but the only one reachable with no credential - 'improper enforcement of security restrictions on the A2A public endpoint' - and the headline is what an operator reads first. The rest publish to /cve via `cves`: CVE-2026-19295 (9.9, OS commands in the server process by saving a flow with a crafted type field), CVE-2026-18729 (8.8, improper control of generation of code), CVE-2026-18891 (8.2, improper authentication - execute arbitrary flows and read their data), CVE-2026-18904 (8.2, namespace collision between user identities, cross-user message injection), CVE-2026-18899 (7.5, arbitrary file read by path traversal), CVE-2026-19294 (6.4, execute and read any user's private flow), CVE-2026-18545 (4.3, SSRF). RANGE IS THE ADVISORY'S OWN WORDING, NOT A GUESSED FIX: `le 1.11.1` inclusive because every id reads 'through 1.11.1' and IBM names no fixed version, so inventing `lt 1.11.2` would flag a patched build - the failure mode worse than under-reporting (docs/severity-standard.md, /daily-cve 5b claim 3). `ge 1.0.0` for the same reason, so a 0.x build is not claimed. VERSION SOURCE is unchanged and already proven live: /api/v1/version answers anonymously with {"version":"1.2.0",...,"package":"Langflow"}, captured by the tech_signatures Langflow row added 2026-08-05 - so like the two rows above, this one needs the interface_tools change that feeds probe_unauth_interfaces responses to techdb, i.e. it is reachable from an IMAGE release, not from the pack bundle alone. JOIN RE-MEASURED 2026-08-29 at the matcher (tests/integration/tech_version_from_checks.py): known_vulns_for returns this row at 1.10.4, 1.11.0 and 1.11.1, does NOT return it at 1.11.2 or 0.9.9, and at 1.2.0 returns it alongside both rows above, which is correct - a 1.2.0 install sits inside all three ranges.