Skip to main content

IBM Langflow OSS EUVDEUVD-2026-53568

| CVE-2026-9081 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-05 ibm GHSA-fqv5-gx59-2xgv
IBM SSRF Langflow Oss
7.1
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
vuln.today AI
7.1 HIGH

Network-accessible API requires low-privilege authentication (PR:L); no complexity barriers; high confidentiality from internal service access; low integrity from potential side-effect requests; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 05, 2026 - 18:21 vuln.today
CVE Published
Aug 05, 2026 - 17:38 cve.org
HIGH 7.1

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).

AnalysisAI

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege Langflow credentials
Delivery
Invoke validate_model_provider_key() with crafted OLLAMA_BASE_URL
Exploit
Server issues unvalidated HTTP GET to attacker-supplied address
Execution
Internal network service responds to application
Impact
Attacker reads sensitive response data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Authentication is required: the CVSS vector specifies PR:L (low-privilege credentials), meaning the attacker must hold a valid Langflow application account. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores 7.1 and accurately characterizes the attack surface: network-accessible, low complexity, requiring only low-privilege authentication, with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privilege Langflow account - such as a developer account in a shared deployment - calls the validate_model_provider_key() API endpoint supplying OLLAMA_BASE_URL set to http://169.254.169.254/latest/meta-data/ (AWS instance metadata) or http://192.168.1.1/admin. The Langflow server faithfully issues a GET request to that address and may return the response to the caller, allowing the attacker to harvest cloud credentials, map internal services, or probe otherwise-inaccessible administrative interfaces. …
Remediation The vendor has released a patch confirmed by IBM's advisory at https://www.ibm.com/support/pages/node/7282650; however, the exact fixed version number was not specified in the available intelligence data - consult the advisory directly to identify the minimum safe version and apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all IBM Langflow OSS deployments currently running versions 1.0.0 through 1.10.3, and identify instances with AI provider integration enabled that have network access to sensitive internal systems. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Langflow Oss

View all
CVE-2026-9198 CRITICAL POC
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
CVE-2026-10561 CRITICAL
10.0 Jun 22

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
CVE-2026-9135 CRITICAL
9.9 Jul 17

Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
CVE-2026-8476 CRITICAL
9.9 Jul 17

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
CVE-2026-8481 CRITICAL
9.9 Jul 17

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
CVE-2026-8859 CRITICAL
9.9 Jul 17

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
CVE-2026-12946 CRITICAL
9.9 Jul 30

Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
CVE-2026-13435 CRITICAL
9.9 Jul 30

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
CVE-2026-8635 CRITICAL
9.9 Jul 17

Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
CVE-2026-7873 CRITICAL
9.9 Jun 30

Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
CVE-2026-8505 CRITICAL
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication

CVE-2026-12940 CRITICAL POC
9.8 Jul 30

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-53568 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy