IBM Langflow OSS EUVD-2026-75795

Exploitation requires a valid authenticated session with at least low-privileged access to the IBM Langflow OSS instance (PR:L per CVSS). The attacker must be able to supply or modify API endpoint URL values in user-controlled parameters - this is the core prerequisite implied by 'improper validation of user-controlled API endpoints.' No additional non-default configuration is described as required. Exploitation is limited by: (1) mandatory authentication - unauthenticated attackers cannot exploit this; (2) the impact is read-only confidentiality (C:L, I:N, A:N), so attackers cannot modify or destroy data via this vector alone; (3) the severity of information disclosure depends heavily on what internal services the Langflow host can reach, meaning impact varies significantly by deployment environment.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, score 5.0) accurately reflects a moderate-severity, authenticated SSRF with limited but scope-changing confidentiality impact. PR:L confirms that exploitation requires a valid low-privileged account, which materially limits the attacker population compared to unauthenticated SSRF. The S:C/C:L pairing is consistent with SSRF scenarios where the vulnerable component can proxy requests into internal network segments, leaking partial responses from internal services. No KEV listing and no POC availability indicate no confirmed active exploitation. EPSS data was not provided; given the authentication requirement and limited confidentiality impact, real-world urgency is lower than for unauthenticated SSRF variants. For Langflow deployments that process user-supplied API integrations against cloud-hosted infrastructure (AWS/Azure/GCP), the IMDS credential-theft risk elevates practical severity beyond the base score - defenders should assess whether their deployment environment exposes link-local metadata services.

An attacker with a valid low-privileged Langflow account submits a crafted API endpoint URL (e.g., pointing to the AWS IMDS endpoint http://169.254.169.254/latest/meta-data/iam/security-credentials/) as a user-controlled parameter in a workflow or integration configuration. The Langflow server issues an outbound HTTP request to that address and returns or logs part of the response, disclosing IAM role credentials or other internal service data to the attacker. No public proof-of-concept has been identified, but this is a well-understood SSRF exploitation pattern.