IBM Langflow OSS CVE-2026-17631

Exploitation requires a valid authenticated session on the Langflow instance (PR:L - any low-privileged user account suffices). The attacker must be able to reach the Langflow web interface or API over the network (AV:N). No user interaction by a privileged party is needed once the attacker has their own session. Impact is amplified when: (1) Langflow is deployed in a cloud environment without IMDSv2 enforcement, enabling metadata credential theft; (2) internal services are reachable from the Langflow host without egress controls. Impact is limited when: strict outbound firewall rules block RFC-1918 and metadata ranges, or when Langflow is deployed on isolated networks with no sensitive internal services. The authentication requirement means unauthenticated internet scanners cannot exploit this without first obtaining credentials.

The CVSS 3.1 base score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) reflects network-exploitable SSRF with scope change but low confidentiality impact and an authentication prerequisite. Real-world risk is meaningfully elevated above the base score in cloud deployments: if Langflow is deployed on AWS, GCP, or Azure with IMDSv2 not enforced, SSRF can retrieve instance metadata and IAM credentials, constituting a critical lateral movement vector despite the C:L label. Conversely, in hardened on-premise environments with network egress controls, actual impact is limited to internal port scanning and banner grabbing. No public exploit code exists and this CVE is absent from the CISA KEV catalog, suggesting no current widespread exploitation. EPSS data was not provided but is expected to be low given the authentication requirement and niche product footprint. The authentication barrier (PR:L) is the primary risk limiter - any authenticated Langflow user, including low-privileged accounts, can trigger the SSRF. Organizations running Langflow in cloud environments with unrestricted outbound access should treat this as higher priority than the base score implies.

An authenticated Langflow user - such as a low-privileged team member or a compromised account - crafts a workflow node or API request that supplies an internal URL (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) as the target for a server-side fetch operation. The Langflow server processes the request and returns the response to the attacker, disclosing cloud instance metadata or internal service responses. No public exploit code exists, but SSRF payloads targeting cloud metadata are well-documented and trivial to construct by any attacker with Langflow access.