IBM Langflow OSS CVE-2026-104331

Exploitation requires an authenticated session on IBM Langflow OSS (CVSS PR:L), so the attacker must already possess or obtain valid application credentials - this is the primary limiting factor. The flaw is a server-side request forgery in Langflow OSS versions 1.0.0 through 1.12.3; the specific component, parameter, or URL-handling feature that accepts the attacker-controlled destination is not described in the available sources. No user interaction is needed (UI:N) and the instance must be network-reachable to the attacker (AV:N). Impact is bounded to limited confidentiality and integrity (C:L/I:L, A:N), consistent with internal network enumeration and request relaying rather than full compromise.

This is a moderate, defense-in-depth-class issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity SSRF that requires an already-authenticated attacker (PR:L) and yields only limited confidentiality and integrity impact with no availability effect. The vendor-assigned priority is 'this_month', which is consistent with medium severity and no sign of urgency. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, so there is no signal of active or widespread exploitation; absence of these is not itself evidence of safety but does argue against emergency prioritization. The one reference is a vendor patch page, not a proof-of-concept. The signals are mutually consistent (authenticated, limited-impact SSRF with a fix available and a non-urgent vendor label), so there is no conflict to flag - the main caveat is that EPSS/KEV/POC data is simply missing rather than contradictory.

An attacker who already holds valid Langflow OSS credentials supplies a crafted URL or component input that causes the server to issue attacker-controlled outbound requests. Because the request originates from the Langflow host, the attacker can probe internal hosts and ports or reach services otherwise shielded from the external network. No public exploit code is identified in the supplied data, and exploitation requires authentication.