What is the CVSS score of CVE-2026-9081?

CVE-2026-9081 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by CVE-2026-9081?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a server-side request forgery vulnerability that allows authenticated users with low privileges to coerce the application into making arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-9081?

Within 24 hours: inventory all IBM Langflow OSS deployments currently running versions 1.0.0 through 1.10.3, and identify instances with AI provider integration enabled that have network access to sensitive internal systems. Within 7 days: apply the vendor-released patch per IBM's advisory to upgrade all affected Langflow installations to the fixed version. Within 30 days: review and enforce network segmentation to isolate Langflow deployment networks from sensitive internal infrastructure, implement outbound HTTP/HTTPS access controls limiting Langflow instances to approved external AI providers only, and audit application logs for suspicious outbound requests during the vulnerability exposure window.

IBM Langflow OSS CVE-2026-9081

EUVD-2026-53568 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-05 ibm

GHSA-fqv5-gx59-2xgv

SSRF IBM Langflow Oss

7.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-accessible API requires low-privilege authentication (PR:L); no complexity barriers; high confidentiality from internal service access; low integrity from potential side-effect requests; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 18:21 vuln.today

CVE Published

Aug 05, 2026 - 17:38 cve.org

HIGH 7.1

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).

AnalysisAI

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes the root cause: the application acts as an unintended proxy because user-controlled input is passed unsanitized to an HTTP client library. Specifically, the validate_model_provider_key() function in the Ollama LLM provider integration accepts the OLLAMA_BASE_URL parameter - intended to point to a local or remote Ollama inference server - without performing any of the standard SSRF mitigations: no URL scheme restriction (e.g., only http/https to known hosts), no allowlist of permitted hosts or domains, and no deny-list for private IP ranges (127.x.x.x, 10.x.x.x, 172.16-31.x.x, 192.168.x.x, 169.254.x.x). The Python requests library then faithfully issues the HTTP GET to whatever URL the attacker supplies. The affected product, identified by CPE cpe:2.3:a:ibm:langflow_oss, is IBM's distribution of Langflow, an open-source LLM orchestration and workflow builder. The vulnerability surfaces in the AI provider configuration/validation API layer, a feature that is inherently part of the product's core integration workflow.

RemediationAI

The vendor has released a patch confirmed by IBM's advisory at https://www.ibm.com/support/pages/node/7282650; however, the exact fixed version number was not specified in the available intelligence data - consult the advisory directly to identify the minimum safe version and apply it immediately. As an immediate workaround pending upgrade, network-level egress filtering on the host running Langflow should be enforced to block outbound HTTP/HTTPS to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16); this prevents successful SSRF pivots even if the vulnerable code path is triggered, though it does not eliminate the vulnerability itself. Additionally, restricting access to the Ollama provider configuration API to trusted administrators or service accounts (enforcing least-privilege user roles) reduces the pool of users who can supply malicious OLLAMA_BASE_URL values. If cloud metadata service access is a concern (e.g., AWS IMDSv1), enforce IMDSv2-only on the hosting instance as an independent control.