IBM Langflow OSS CVE-2026-12767

No authentication is required - the CVSS vector PR:N/UI:N confirms unauthenticated exploitation is possible against any network-reachable Langflow OSS instance in the affected version range. No special configuration setting needs to be enabled; the SSRF vector is inherent to the application's core HTTP-fetching functionality. Exploitation is limited by: (1) the Langflow server must be network-accessible to the attacker (internet-facing instances are most exposed); (2) the value of exploitation scales with the Langflow server's internal network access - instances with no privileged intranet reach or metadata API access yield only basic enumeration; (3) cloud metadata credential theft via SSRF requires IMDSv1 to be enabled on the host (IMDSv2-only environments mitigate this specific escalation path).

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a realistic but moderate threat: the attack is trivially reachable without authentication or user interaction, but direct impact is bounded to limited confidentiality and integrity effects on the vulnerable system itself. SSRF in this context is most dangerous when the Langflow server has privileged network access - for example, when deployed in cloud environments where cloud metadata APIs (e.g., AWS IMDSv1 at 169.254.169.254) are accessible, or where internal microservices lack authentication because they assume perimeter trust. There is no KEV listing and no known POC, suggesting exploitation has not been observed in the wild. EPSS data is not available in the provided intelligence. The S:U scope metric may understate risk in cloud-native deployments where SSRF can pivot to credential theft via metadata endpoints, a scenario not reflected in the base score. Overall, this is a real-but-moderate priority: critical for internet-exposed Langflow instances in cloud environments, lower priority for air-gapped or internally-only deployed instances.

An unauthenticated attacker sends a crafted HTTP request to a publicly exposed Langflow OSS endpoint, supplying a URL pointing to an internal resource such as http://192.168.1.1/admin or http://169.254.169.254/latest/meta-data/. The Langflow server fetches the target URL and returns the response to the attacker, exposing internal service banners, configuration data, or cloud IAM credentials. No prior account or interaction with any user is required.