IBM Langflow Desktop CVE-2026-3341

Exploitation requires a valid low-privileged user account on the IBM Langflow Desktop instance (confirmed by CVSS PR:L). The attack is network-based with no special configuration required beyond having access to the application's interface (AV:N, AC:L). No user interaction by a victim is needed (UI:N). Limiting factors include: the requirement for prior authentication with at least low-privileged credentials prevents fully unauthenticated exploitation; scope is unchanged (S:U) so the SSRF alone does not directly compromise other systems; and real-world impact escalation depends on what internal services or metadata endpoints are reachable from the server's network position.

The CVSS 5.4 Medium score is consistent with real-world risk assessment for this vulnerability class. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N conveys that exploitation is straightforward from a network perspective once credentials are obtained, but the PR:L requirement is a meaningful barrier - unauthenticated exploitation is not supported by the available data. Scope is unchanged (S:U), meaning the attacker cannot directly pivot to compromise adjacent systems through this vulnerability alone, though SSRF is commonly chained with other weaknesses. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis, placing this in a lower active-exploitation tier. The primary real-world concern is use of SSRF for internal network enumeration or metadata service abuse in cloud-hosted deployments, which could amplify the confidentiality impact beyond what the C:L metric alone suggests.

An authenticated Langflow Desktop user submits a workflow node or API call containing a crafted URL targeting an internal service - such as http://192.168.1.1/admin or http://169.254.169.254/latest/meta-data/ - causing the Langflow server process to issue the request and return the response to the attacker. No public POC has been identified, but SSRF exploitation techniques against this class of vulnerability are widely documented and require no specialized tooling beyond standard HTTP clients. In cloud deployments, successful retrieval of instance metadata could expose IAM credentials or other sensitive configuration.