IBM Langflow OSS CVE-2026-81213

Exploitation requires network-level access to an IBM Langflow OSS instance running versions 1.0.0 through 1.11.5. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or special attack conditions are required - any party who can reach the Langflow HTTP interface can attempt exploitation. The attacker must interact with a feature within Langflow that performs server-side HTTP requests using user-supplied URLs (such as URL-fetching nodes or data ingestion connectors). Full confidentiality impact against cloud metadata services requires the Langflow host to be deployed in a cloud environment where IMDS is reachable; against other internal resources, the host must have network-level access to those targets. Impact is confidentiality-only (I:N/A:N per CVSS) - write operations and service disruption are not achievable via this vulnerability alone.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (8.6) is well-calibrated for this SSRF class: network-accessible with no authentication, no user interaction, low complexity, and a scope change that exposes downstream internal systems at high confidentiality impact. The combination of PR:N and AV:N means any internet-exposed Langflow instance is reachable without credentials. The scope change (S:C) is the key risk amplifier - an attacker is not limited to Langflow's own data but can reach cloud Instance Metadata Service (IMDS) endpoints (e.g., 169.254.169.254 on AWS/GCP/Azure) to harvest IAM credentials, internal REST APIs, or private network services. EPSS data was not provided; CISA KEV status is negative (no confirmed active exploitation). No POC has been identified, lowering near-term automated exploitation risk. Practical risk is strongly gated on whether the Langflow deployment faces untrusted networks: hardened, access-controlled internal deployments face substantially lower exposure than internet-facing or developer-shared instances.

An unauthenticated attacker with network access to a Langflow OSS instance submits a crafted URL (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) into a Langflow workflow node or URL-loading feature. The Langflow server issues the request and returns the response - including cloud IAM role credentials - to the attacker, enabling subsequent unauthorized access to cloud services. No POC has been identified, but the attack follows standard well-documented SSRF techniques and requires no specialized tools.