EUVD-2026-40400
GHSA-rqjv-px3w-v3w6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description states an authenticated attacker, so PR:L rather than PR:N; network low-complexity SSRF disclosing cloud credentials/metadata gives C:H with minor I:L and no availability impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), potentially exfiltrating IAM credentials and enumerating internal networks. The vulnerability can also be triggered through prompt injection in agentic workflows due to tool_mode=True exposure.
AnalysisAI
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.6 lets an attacker coerce the application into making arbitrary HTTP requests via the legacy RSSReaderComponent (rss.py) and the SearXNG component (searxng.py), which fetch user-controlled URLs without validation. These two components bypass the SSRF protections that were added in version 1.9.3, allowing reach into internal resources such as AWS/Azure/GCP instance metadata (IMDS) to steal IAM credentials and enumerate internal networks. The flaw is reachable directly by an authenticated user and indirectly through prompt injection in agentic workflows because the components are exposed with tool_mode=True; no public exploit identified at time of analysis.
Technical ContextAI
Langflow is an open-source, low-code platform for building LLM/agentic applications by wiring together components. The root cause is CWE-918 (Server-Side Request Forgery): two server-side components accept a URL parameter and issue outbound HTTP requests on the server's behalf without enforcing the URL allow/deny validation that was centrally introduced in 1.9.3. Because the RSSReaderComponent and SearXNG component were not routed through that validation layer, they act as an open proxy from the server's network position. The agentic exposure (tool_mode=True) means these components are also callable by an LLM agent as tools, so attacker-controlled prompt content can drive the same outbound requests - a second, indirect trigger path that broadens the realistic attack surface beyond direct API calls.
RemediationAI
Consult the IBM advisory at https://www.ibm.com/support/pages/node/7277995 for the fixed release; the input does not include an exact patched version, so no vendor-released fixed version is independently confirmed at time of analysis - apply the remediation IBM specifies for builds after 1.9.6. As compensating controls until patched, disable or remove the RSSReaderComponent and SearXNG components from flows and set tool_mode=False so they cannot be invoked as agent tools, accepting that RSS ingestion and SearXNG search features become unavailable. At the infrastructure layer, enforce IMDSv2 (token-required) and block egress from the Langflow host to 169.254.169.254 and other link-local/internal ranges via host firewall or security-group rules, noting that any legitimate metadata or internal-service calls from the app will then break and must be explicitly allowlisted. Finally, restrict and audit who can author or run flows, since authentication is a prerequisite, and place the application behind an egress proxy that allowlists only required external destinations.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today