IBM Langflow OSS CVE-2026-18545

Exploitation requires a valid authenticated session with at least low-privilege access to the Langflow OSS instance (confirmed by CVSS PR:L). No elevated administrative role is required beyond a standard user account. The vulnerability is reachable over the network with no special network position required (AV:N, AC:L). No user interaction beyond the attacker's own actions is needed (UI:N). Exploitation is limited to scenarios where the attacker can authenticate - unauthenticated exploitation is not supported by the CVSS vector. The real-world impact is further constrained by the network reachability of the Langflow server's egress path: if the server cannot reach internal metadata services or private IP ranges, the enumeration value is reduced.

The CVSS base score of 4.3 (Medium) reflects a real but bounded risk: the network attack vector and low complexity lower the bar for exploitation, but the PR:L requirement limits exposure to authenticated users only. EPSS data was not provided, so exploitation probability is not quantifiable from available signals. No KEV listing exists and no public POC has been identified, further reducing near-term exploitation urgency. The confidentiality impact is rated Low (C:L), consistent with the described capability of network enumeration rather than direct data exfiltration. However, in practice, SSRF in AI pipeline tools can be more impactful than the score suggests: Langflow instances are frequently deployed adjacent to cloud metadata services (AWS IMDSv1, GCP metadata API) and internal tooling, meaning a successful SSRF could retrieve cloud credentials or probe sensitive internal endpoints - impacts not fully captured in the base vector. The risk should be treated as medium-high in cloud-hosted deployments and lower in air-gapped or tightly network-segmented environments.

An attacker with a valid Langflow user account crafts a workflow node or API request that specifies an attacker-controlled internal URL as a target - for example, the AWS EC2 instance metadata endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/. The Langflow server fetches the URL and returns the response, allowing the attacker to harvest cloud IAM credentials or map internal network topology. No public POC exists at time of analysis, but the attack pattern is well-understood for SSRF vulnerabilities in application frameworks of this type.