IBM Langflow OSS CVE-2026-12765

Exploitation requires network access to an exposed IBM Langflow OSS instance running versions 1.0.0 through 1.10.2. No authentication is required (CVSS PR:N, UI:N) - the vulnerability is reachable by any client that can send HTTP requests to the application. The primary limiting factor is deployment exposure: instances accessible only on internal networks behind authentication proxies are substantially harder to exploit. The severity of outcome depends heavily on the cloud/network environment: instances running in cloud environments with IMDSv1-style metadata services or flat internal networks face greater practical impact. No specific non-default feature flag or configuration setting is identified as required by the description.

The reported CVSS base score of 6.5 (Medium) is broadly consistent with a standard SSRF with limited direct impact - C:L/I:L and no availability impact. The attack complexity is Low and no authentication is required (PR:N), meaning any internet-facing Langflow instance is a candidate target. No CISA KEV entry and no known public exploit code exist at time of analysis, and the EPSS signal is absent from the provided data, so opportunistic mass exploitation has not been confirmed. However, real-world SSRF risk often exceeds nominal CVSS scoring in cloud-deployed environments: unauthenticated SSRF against a Langflow instance running in AWS/GCP/Azure could reach instance metadata services (IMDSv1, GCE metadata) and yield credentials, elevating practical impact well beyond C:L. The scope metric S:U may understate lateral-movement risk in cloud environments. No data conflicts are present in the input, but the absence of EPSS data limits probabilistic comparison.

An unauthenticated attacker identifies an internet-facing Langflow OSS instance and submits a crafted workflow or API call that causes the server to issue HTTP requests to internal addresses such as http://169.254.169.254/latest/meta-data/ (AWS IMDSv1) or RFC-1918 addresses on the internal network. The server returns or leaks portions of internal responses, enabling the attacker to enumerate services, extract cloud credentials from metadata endpoints, or probe otherwise-inaccessible internal infrastructure. No public POC is required at this stage given the inherent simplicity of SSRF exploitation against unauthenticated endpoints.