CVE-2026-7754
MEDIUM
CVSS 6.5
langflow_oss
Verified Advisory
Server-side request forgery (SSRF) in IBM Langflow OSS (CVE-2026-7754)
CVE-2026-7754 is a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS affecting versions 1.0.0 through 1.10.0. The vulnerability arises from an insecure default configuration and incomplete enforcement of the SSRF protection mechanism, where the `ssrf_protection_enabled` setting could be set to `False`, bypassing all URL validation. This could allow an authenticated remote attacker to cause the server to fetch arbitrary URLs, including cloud metadata endpoints, internal services, and Docker daemon APIs.
Affected versions:
- 1.0.0-1.10.0
We recommend updating to: 1.10.1.
CVSS 7.7 · our assessment: this_week
Vendor advisory: https://www.ibm.com/support/pages/node/7278930
Details: https://vuln.today/cve/CVE-2026-7754
Verified by vuln.today against published advisories.
Affected versions
- – 1.0.0-1.10.0
Fixed in: 1.10.1
More advisories for langflow_oss
- CVE-2026-13446 – Hard-coded credentials in IBM Langflow OSS (CVE-2026-13446)
- CVE-2026-13445 – Insecure file path handling in IBM Langflow OSS (CVE-2026-13445)
- CVE-2026-13448 – Unauthenticated remote code execution in IBM Langflow (CVE-2026-13448)
- CVE-2026-14499 – OS command injection in IBM Langflow OSS Python Interpreter (CVE-2026-14499)
- CVE-2026-7667 – Path traversal in the API Request component of IBM Langflow OSS (CVE-2026-7667)
- CVE-2026-7872 – Path traversal in Langflow OSS File component tar extraction (CVE-2026-7872)
- CVE-2026-7755 – Remote code execution in IBM Langflow OSS (CVE-2026-7755)
- CVE-2026-8056 – Code injection in Langflow OSS API Graph Execution Engine (CVE-2026-8056)