IBM Langflow EUVD-2026-40402

Exploitation requires an authenticated, low-privileged account on the Langflow instance (PR:L) and the ability to invoke the URL data-source component with an attacker-supplied URL. The attacker must control an authoritative DNS server for the target hostname to perform DNS rebinding, and must win the Time-of-Check/Time-of-Use race between Langflow's host validation and its actual fetch - this is the primary limiting factor (reflected in AC:H) and may require many attempts. Affected only on versions 1.0.0-1.9.3 where this URL component is reachable; deployments that disable the URL component, isolate the server from internal networks/metadata endpoints, or restrict it to fully trusted users are not realistically exploitable. No user interaction by a victim is needed (UI:N).

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, score 7.1) tells a consistent story: network-reachable but requiring some privileges (PR:L, an authenticated user able to invoke the URL component) and high attack complexity (AC:H) because the DNS-rebinding race must be won reliably. The scope change (S:C) and high confidentiality impact (C:H) reflect that successful SSRF can reach internal-only services and cloud metadata endpoints. No EPSS score, no POC, and no KEV listing were provided, so there is no current signal of active or widespread exploitation; absence of EPSS data means probabilistic exploitation likelihood cannot be quantified here. Net: a genuine but conditional risk - meaningful in multi-tenant or internet-exposed Langflow deployments where untrusted users have accounts, lower priority for single-user or network-isolated installations. The AC:H rating should temper urgency relative to a trivially exploitable SSRF.

An attacker registers or obtains a low-privileged Langflow account, builds a flow using the URL component, and points it at a hostname they control whose DNS alternates between a public IP (passing validation) and an internal target such as the cloud metadata service. By winning the TOCTOU race via rapid DNS rebinding, the server fetches internal-only data (e.g. cloud credentials or internal admin endpoints) and returns it to the attacker. No public POC is identified at time of analysis, and the high attack complexity means reliable exploitation requires repeated attempts to win the race.