IBM Langflow OSS EUVD-2026-78084

Exploitation requires a valid authenticated user account on the Langflow OSS instance (PR:L per CVSS). The attack is network-based (AV:N) and requires no user interaction beyond the attacker's own actions (UI:N). Attack complexity is low (AC:L), meaning no race condition, special timing, or environmental configuration beyond authentication is needed. Exploitation is limited by: (1) the authentication requirement - unauthenticated access is not sufficient; (2) the scope is unchanged (S:U), meaning the vulnerability does not by itself cross privilege boundaries to compromise the underlying host OS; and (3) impact is bounded to limited confidentiality and integrity (C:L/I:L), with no direct availability impact (A:N). Non-default deployment behind an authenticating reverse proxy or restricted to a private network further limits real-world exploitability.

The CVSS 5.4 Medium score accurately reflects a constrained but real exposure: network-reachable, low complexity, but gated behind authenticated access (PR:L), which meaningfully limits the attacker population to registered or compromised users. The impact metrics of C:L and I:L reflect the indirect nature of SSRF - the attacker does not directly read arbitrary files or write data on the target, but rather co-opts the server's network identity to probe or interact with internal infrastructure. EPSS data is not included in the provided intelligence, and no CISA KEV listing exists, suggesting this is not under active mass exploitation. No public proof-of-concept has been identified. Taken together, even a mid-sized municipal IT team in ustka operating an internal Langflow deployment should treat this as a moderate priority remediation rather than an emergency response, particularly if the Langflow instance is already behind authentication and not exposed directly to the internet. The absence of a scope-change (S:U) in the CVSS vector is notable: while SSRF can sometimes pivot to full internal-network compromise, the scoring here constrains it to bounded impact, which is consistent with IBM's description of 'network enumeration or facilitating other attacks' rather than confirmed code execution.

An authenticated Langflow user with access to a workflow node that accepts URL input supplies a crafted internal address (such as an AWS EC2 metadata endpoint or an intranet admin panel URL) as the target. The Langflow server fetches the attacker-supplied URL and the response - potentially containing internal credentials, host information, or service banners - is surfaced back to the attacker through the workflow output or an error message, enabling reconnaissance of the internal network.