What is the CVSS score of CVE-2026-7657?

CVE-2026-7657 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-7657?

Yes, a patch is available for CVE-2026-7657. Update the affected software to the latest version immediately.

IBM Langflow OSS CVE-2026-7657

EUVD-2026-53567 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-05 ibm

GHSA-94h9-q657-456h

SSRF IBM Langflow Oss

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via authenticated workflow input (PR:L); low complexity bypass of existing filter; confidentiality-only impact with no integrity or availability effect and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:21 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.

AnalysisAI

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.3 allows low-privileged authenticated users to force the server to make arbitrary outbound HTTP requests to internal or restricted network destinations due to incomplete enforcement of the platform's built-in SSRF protections. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation at low complexity with high confidentiality impact, making cloud metadata endpoints and internal services realistic targets. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

Langflow is a visual, open-source framework for constructing LLM-powered workflows, originally by Logspace and distributed under IBM branding via IBM Langflow OSS. CWE-918 (Server-Side Request Forgery) describes a class of flaw where an application fetches attacker-controlled URLs on behalf of a user without adequately validating the destination. The advisory language - 'incomplete and ineffective SSRF protection enforcement' - is particularly significant: it implies Langflow did implement some form of URL validation or allow/deny-list, but the implementation contains bypasses. Common bypass vectors for such controls include use of IPv6 addresses, decimal or octal IP encoding, DNS rebinding, HTTP redirects to internal targets, or alternative URL schemes (e.g., dict://, gopher://). CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* scopes the affected surface to the IBM-packaged OSS distribution. The CVSS PR:L metric indicates a workflow participant (authenticated user) - not an anonymous external actor - supplies the malicious URL to a component the backend fetches.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7282650. The exact patched release version is not independently confirmed from the available input data - consult the advisory directly to identify the target upgrade version before deployment. As a compensating control while patching is in progress, enforce strict network egress filtering on the Langflow server host to deny outbound access to RFC-1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16 including the cloud metadata endpoint at 169.254.169.254), and loopback (127.0.0.0/8); note that this mitigates impact but does not eliminate the underlying bypass, and some internal services may legitimately require egress that this control would block. Restricting Langflow access exclusively to trusted, explicitly provisioned users limits the attacker pool but does not remediate the flaw. Disabling workflow components that accept arbitrary user-supplied URLs reduces attack surface at the cost of reduced workflow functionality.