Skip to main content

IBM Langflow OSS EUVDEUVD-2026-78083

| CVE-2026-12767 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-09-14 ibm GHSA-jvmc-mxmx-5qwq
SSRF IBM Langflow Oss
6.5
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Unauthenticated network attack with no complexity; limited confidentiality and integrity impact consistent with SSRF-only enumeration without confirmed scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
Analysis Generated
Sep 15, 2026 - 08:09 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

AnalysisAI

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required - the CVSS vector PR:N/UI:N confirms unauthenticated exploitation is possible against any network-reachable Langflow OSS instance in the affected version range. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a realistic but moderate threat: the attack is trivially reachable without authentication or user interaction, but direct impact is bounded to limited confidentiality and integrity effects on the vulnerable system itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released patch referenced in IBM's support advisory at https://www.ibm.com/support/pages/node/7286665; the exact fixed version number is not independently confirmed in the available intelligence and should be verified directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Langflow Oss

View all
CVE-2026-9198 CRITICAL POC
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
CVE-2026-19295 CRITICAL POC
9.9 Aug 28

Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
CVE-2026-18729 HIGH POC
8.8 Aug 28

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
CVE-2026-10561 CRITICAL
10.0 Jun 22

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
CVE-2026-9135 CRITICAL
9.9 Jul 17

Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
CVE-2026-8476 CRITICAL
9.9 Jul 17

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
CVE-2026-8481 CRITICAL
9.9 Jul 17

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
CVE-2026-8859 CRITICAL
9.9 Jul 17

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
CVE-2026-12946 CRITICAL
9.9 Jul 30

Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
CVE-2026-13435 CRITICAL
9.9 Jul 30

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
CVE-2026-8635 CRITICAL
9.9 Jul 17

Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
CVE-2026-7873 CRITICAL
9.9 Jun 30

Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-78083 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy