EUVD-2026-40405
GHSA-33xg-qw74-fhr3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Authenticated flow-author (PR:L) over the network with low complexity; SSRF reaches other systems (S:C) and discloses sensitive data (C:H), limited integrity from forced requests (I:L), no availability impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the application validates only the initial URL but does not re-validate redirect destinations. This allows attackers to access internal HTTP services, localhost endpoints, cloud metadata services, and private network resources that should be unreachable when SSRF protection is enabled. Successful exploitation can lead to disclosure of sensitive information including credentials, tokens, internal API responses, and administrative panel data.
AnalysisAI
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 lets an authenticated flow-author bypass the API Request component's SSRF protections by toggling the follow_redirects parameter and pointing it at a benign public URL that redirects to internal or localhost targets. Because only the initial URL is validated and redirect destinations are not re-checked, attackers can pivot to cloud metadata services, localhost endpoints, and private-network HTTP services to exfiltrate credentials, tokens, and admin-panel data. No public exploit identified at time of analysis; risk is driven by the CVSS 8.5 rating and the high value of cloud-metadata SSRF targets rather than confirmed in-the-wild use.
Technical ContextAI
Langflow is an open-source, low-code visual framework for building LLM-driven agents and workflows; its API Request component is a built-in node that lets a flow author issue outbound HTTP calls. The flaw is a classic CWE-918 (Server-Side Request Forgery) implemented as a TOCTOU-style validation gap: the SSRF allow/deny check is applied to the user-supplied URL but is not re-applied to the Location header returned on a 3xx redirect. When follow_redirects is enabled, the HTTP client transparently follows the attacker-controlled redirect to an address (e.g., 169.254.169.254 cloud metadata, 127.0.0.1, or RFC1918 ranges) that the original validation would have rejected, so the server itself makes the disallowed request and returns the response to the attacker.
RemediationAI
Upgrade to the IBM-fixed Langflow OSS release noted in the vendor advisory at https://www.ibm.com/support/pages/node/7277561 (a fixed version above 1.9.3 is expected but the exact patched build is not stated in the available data - confirm directly with the advisory before deploying). Until patched, set or enforce follow_redirects=false on API Request components so redirect chains are not followed, which removes the bypass at the cost of breaking flows that legitimately depend on redirects; additionally, restrict the flow-author role to trusted users, place egress filtering in front of Langflow to block outbound access to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges, and where supported enforce IMDSv2 / disable IMDSv1 on cloud hosts so metadata SSRF cannot trivially mint credentials. The egress and metadata controls have minimal side effects; disabling follow_redirects may break legitimate redirect-dependent integrations.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today