IBM Langflow EUVD-2026-40400

Exploitation requires that the deployment use (or expose) the legacy RSSReaderComponent (rss.py) or the SearXNG component (searxng.py), the two components that bypass the SSRF validation added in 1.9.3 - any version 1.0.0 through 1.9.6 is in scope. The attacker must either hold an authenticated Langflow session to configure and run a flow containing these components, or be able to influence an agentic workflow where the components are exposed as tools (tool_mode=True), enabling a prompt-injection trigger. High-value impact specifically requires that the server can reach an internal or cloud-metadata endpoint (e.g., IMDSv1 at 169.254.169.254 reachable and not enforced as IMDSv2). Limiting factors: the description states authentication is needed (conflicting with the NVD PR:N vector), the vulnerable components must be present and enabled, and cloud credential theft depends on reachable, token-less metadata services.

Signals are mostly consistent toward a real, prioritizable issue but contain one notable conflict. The NVD CVSS 3.1 vector (8.2, AV:N/AC:L/PR:N/UI:N/C:H/I:L) describes a network, low-complexity, no-privilege, high-confidentiality SSRF; however, the description explicitly states 'an authenticated attacker,' which contradicts PR:N - verify the privilege requirement with the vendor, as authentication materially lowers exposure versus a truly unauthenticated flaw. No EPSS score, KEV listing, or POC was supplied, so probability of widespread exploitation cannot be quantified and there is no public exploit identified at time of analysis. The impact is credible and high-value: SSRF into cloud IMDS commonly yields IAM credentials, enabling lateral movement and privilege escalation in cloud deployments, which is why C:H is justified even though availability is unaffected. Net assessment: a meaningful priority for cloud-hosted Langflow instances (especially where metadata service v1 is reachable), but the requirement for an authenticated session and/or an agent path reaching these components tempers the raw-CVSS urgency.

An authenticated Langflow user - or an attacker who has injected a malicious prompt into an agentic workflow where these components run as tools with tool_mode=True - configures an RSSReader or SearXNG component to fetch http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server makes the request from its own network position, bypassing the 1.9.3 SSRF controls, and returns the cloud IMDS response, exfiltrating temporary IAM credentials that are then used to pivot into the victim's cloud account. No public exploit identified at time of analysis.