IBM Langflow CVE-2026-10129

Exploitation requires an authenticated account with the flow-author role (CVSS PR:L) and that the attacker enable the follow_redirects parameter on the API Request component - that toggle being on is the specific feature condition that triggers the bypass. The attacker must also control (or be able to reach) an intermediate public URL that issues an HTTP 3xx redirect to the intended internal/localhost/metadata target. Limiting factors: it is NOT unauthenticated (an account is mandatory), it only matters when Langflow's SSRF protection is otherwise enabled, and value is highest in cloud or multi-tenant deployments where reachable internal targets (metadata endpoints, admin panels) exist; in an isolated instance with no internal services reachable from the host, impact is reduced.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) is internally consistent with the description: network-reachable, low-complexity, requires only low-privilege authenticated access (the flow-author role), no user interaction, with a scope change reflecting that the SSRF reaches systems beyond the Langflow process and high confidentiality impact from leaked credentials/metadata. The principal limiting factor is authentication - an attacker must already hold a flow-author account, which downgrades this from a fully unauthenticated internet-facing SSRF to a privileged-insider or post-account-compromise vector; this is meaningful in multi-tenant or shared Langflow deployments. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so exploitation likelihood cannot be quantified from data - the score is a severity ceiling, not evidence of active exploitation. The follow_redirects requirement is a concrete, attacker-controllable toggle rather than a rare server-side configuration, so the technical barrier is low once an account is held.

An attacker who holds (or phishes/compromises) a low-privilege flow-author account in a shared Langflow instance builds a flow with an API Request node, enables follow_redirects, and sets the URL to an attacker-controlled public server that 302-redirects to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Langflow validates only the benign public URL, follows the redirect server-side, and returns the cloud IAM credentials to the attacker. Given AV:N/AC:L the request requires no special timing or tooling beyond a normal browser session against the Langflow UI/API.