IBM Langflow OSS EUVD-2026-113154

Exploitation requires an authenticated session against a network-reachable Langflow OSS instance (CVSS PR:L), with no user interaction needed. The exact product feature or input that triggers the server-side request forgery is not described in the available sources, so the concrete trigger cannot be named; practical impact depends on what internal services are reachable from the Langflow server's network position (the changed scope indicates it can reach systems the attacker cannot directly). Limiting factors: valid credentials are required, the impact is confined to confidentiality (no integrity or availability effect), and only versions 1.0.0 through 1.12.3 are affected - upgrading to the IBM-patched release removes exposure.

This is a moderate-to-serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity server-side request forgery that requires some level of authentication (PR:L) and no user interaction, with a changed scope and high confidentiality impact but no integrity or availability impact - consistent with an attacker coercing the Langflow server into making requests that disclose sensitive data from otherwise-unreachable internal systems. The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by the vulnerability's inherent properties rather than observed attacker activity. The main signals are coherent (authenticated SSRF with confidentiality-only impact), with no conflicts to flag - the only missing quantitative signal is EPSS, whose absence is not itself an error. Priority is real given the scope change and high confidentiality impact against internet-reachable AI tooling, but the authentication requirement meaningfully narrows the attacker population.

A remote attacker who already holds valid (potentially low-privileged) credentials to a Langflow OSS instance submits input that causes the server to issue attacker-controlled outbound requests, using the server's network position to reach internal metadata endpoints, internal APIs, or other back-end services and return their sensitive responses. Because the CVSS scope is changed, the server acts as a proxy into resources the attacker could not otherwise reach. No public PoC or exploit code is referenced in the available data.