EUVD-2026-40402
GHSA-phxc-h9ch-q3gg
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable SSRF needing an authenticated user (PR:L) and a hard-to-win DNS-rebinding race (AC:H); SSRF crosses trust boundary (S:C) exposing internal data (C:H) with limited integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.
AnalysisAI
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 allows a low-privileged authenticated user to coerce the server into making attacker-controlled internal requests by abusing the URL data-source component, where a Time-of-Check/Time-of-Use race condition lets a hostname resolve to a safe address during validation and a private/internal address at fetch time (classic DNS rebinding). Exploitation is rated CVSS 7.1 with a scope change, reflecting that the server can be made to reach internal services beyond its own trust boundary; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Langflow is an open-source, Python-based visual framework for building LLM and agent workflows; the affected code path is the URL component at src/lfx/src/lfx/components/data_source/url.py, which fetches remote content from user-supplied URLs. The root cause is CWE-918 (SSRF) compounded by a TOCTOU race: the component validates the target host/IP (the 'check') separately from when it actually opens the connection and fetches (the 'use'). Because DNS resolution happens twice, an attacker controlling an authoritative DNS server can return a benign public IP for the validation lookup and then re-bind the same hostname to an internal address (e.g. 169.254.169.254, 127.0.0.1, or RFC1918 ranges) before the fetch, defeating allow/deny-list filtering.
RemediationAI
Upgrade IBM Langflow OSS to a fixed release above 1.9.3 as specified in the IBM advisory at https://www.ibm.com/support/pages/node/7277560 (exact fixed version not stated in the available data - confirm against the advisory before deploying). If immediate patching is not possible, reduce exposure by restricting who can create or run flows that use the URL component (it requires authentication, so tighten account provisioning and remove the component from untrusted users' palettes where feasible), and place Langflow behind an egress-filtering proxy that resolves and pins the destination IP at connection time so DNS rebinding cannot swap the target - note this proxy approach is the most reliable mitigation against TOCTOU rebinding but adds latency and an operational dependency. Additionally, block the server's outbound access to link-local and metadata ranges (169.254.169.254), loopback, and RFC1918 networks at the network layer; the trade-off is that legitimate internal-fetch use cases will break and must be explicitly allow-listed.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today