EUVD-2026-45286
GHSA-7wqc-w7wj-5fm5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Server-side request forgery in IBM Langflow OSS (versions 1.0.0 through 1.10.0, and Langflow 1.9.0) allows an authenticated low-privileged user to coerce the server into making attacker-controlled outbound requests, reaching internal services and exfiltrating their responses. The flaw stems from an insecure default configuration combined with incomplete enforcement of the built-in SSRF protection, meaning the safeguard can be bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Langflow Oss gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.
Executive ViewAI
IBM Langflow (versions 1.0.0-1.10.0 and 1.9.0) contains a server-side request forgery vulnerability allowing authenticated users to bypass built-in protections and direct the server to access internal services, potentially exfiltrating sensitive data. Organizations running affected versions face risk of data breach and unauthorized access to internal infrastructure through compromised low-privilege accounts or malicious insiders. Immediate patching is critical to protect internal resources and connected systems.
Within 24 hours, identify and document all IBM Langflow instances in your environment and determine which are running versions 1.0.0-1.10.0 (OSS) or 1.9.0 (Langflow product). Within 7 days, apply the vendor-released patch to upgrade all affected instances to patched versions. Within 30 days, review server audit logs for unauthorized outbound requests originating from Langflow services, audit workflow configurations created by low-privileged users during the vulnerable period, and implement network egress filtering or segmentation to limit the blast radius of future SSRF exploits.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the servi
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
IBM Langflow OSS 1.0.0 through 1.12.8 allows unauthenticated remote attackers to bypass security restrictions through im
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-l
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run
Remote OS command execution in IBM Langflow OSS (versions 1.0.0 through 1.11.5) lets remote attackers run arbitrary oper
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP `resources/r
Exploit-DB