Langflow OSS CVE-2026-104315

Exploitation requires a valid authenticated Langflow OSS account (CVSS PR:L), so this is not remotely exploitable by anonymous users. The attacker then abuses a server-side request capability to coerce the server into sending requests to attacker-specified destinations; the exact feature, endpoint, or parameter that triggers the SSRF is not described in the available sources. The primary limiting factors are the authentication requirement and the low impact (read-only reconnaissance, C:L with no integrity or availability impact) - practical risk is highest where Langflow is network-exposed, multi-tenant, or deployed alongside sensitive internal services or cloud metadata endpoints. Affected versions are 1.0.0 through 1.12.3; upgrading to the IBM-patched release is the stated fix.

This is a moderate-severity, lower-priority issue rather than an urgent one, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only low confidentiality impact and no integrity or availability impact - consistent with an SSRF used for internal reconnaissance rather than direct data theft or code execution. The vuln.today decision label is 'this_month', not act_now or emergency, aligning with the modest score. No CISA KEV listing and no EPSS score were provided in the input, and no public exploit or PoC reference is present (the only reference is the vendor patch page), so there is no evidence of active exploitation or available exploit code. Key quantitative signals are therefore missing rather than conflicting: EPSS and KEV status are absent, which should be read as 'not supplied' rather than 'zero risk'. The realistic risk is that an attacker who already holds a valid Langflow account could pivot to map internal networks or reach otherwise-unreachable internal services - meaningful in multi-tenant or exposed deployments, but gated behind authentication.

An attacker with a valid, low-privileged Langflow OSS account abuses a server-side request feature to make the Langflow server issue attacker-chosen HTTP requests. They use this to enumerate internal hosts, ports, and services (e.g., cloud metadata endpoints or internal admin panels) that are not reachable from outside, using the responses to plan follow-on attacks. No public exploit code or PoC reference is present in the supplied data.