Description

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T21:17:00.583Z",
  "pubdate": "2026-09-14T21:17:00.583Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.10.2 are susceptible to a server-side request forgery (SSRF) vulnerability. This security flaw enables an unauthenticated remote attacker to force the server to initiate unauthorized outbound requests to arbitrary destinations. By abusing the server's network location, an attacker can bypass perimeter security controls, interact with internal services that are otherwise inaccessible from the public internet, and perform reconnaissance against the host environment. The impact of this vulnerability includes potential network enumeration, unauthorized data exfiltration from internal endpoints, and the facilitation of further exploitation chains against internal infrastructure. Because the application processes user-supplied input to perform requests without sufficient validation or sanitization, the server effectively acts as a proxy for the attacker's malicious traffic. This represents a critical risk to internal network segmentation and overall system integrity.",
  "technicalDetails": "The vulnerability originates from improper handling of user-supplied URLs or network parameters within the Langflow application's request processing logic. When the application interacts with external or internal resources, it fails to enforce strict allow-lists or validate the destination schema, domain, and IP address range of the requested resource. This lack of input sanitization permits an attacker to supply crafted inputs that redirect the server's outbound requests to arbitrary, non-public resources.\nThe attack flow begins with an unauthenticated attacker identifying an entry point within the Langflow interface or API that accepts a URL or network-based input. The attacker supplies a target address pointing to internal infrastructure, such as cloud metadata services (e.g., 169.254.169.254 in cloud environments), local loopback addresses (127.0.0.1), or private network services residing behind the application's firewall. The server, acting as the initiator of the request, executes an HTTP request to this destination. Because the request originates from the server's own context, it is often trusted by internal services that do not require additional authentication.\nThe root cause is a failure in the application's design to implement a robust proxy or request-filtering mechanism. Specifically, the application does not verify the destination IP against a blocked set of private or loopback ranges, nor does it enforce protocol restrictions to prevent interaction with non-HTTP services. Consequently, the attacker can leverage the server's network stack to probe open ports, perform banner grabbing, or interact with administrative interfaces.\nThe exploitation process typically involves: 1. Identification of the vulnerable endpoint within Langflow that performs outbound requests. 2. Construction of a malicious payload targeting internal network segments or sensitive service ports. 3. Transmission of the payload to the application, triggering the server-side request. 4. Observation of the application response or side-channel behavior to map the internal network topology or exfiltrate sensitive configuration data returned by internal endpoints. Post-exploitation impact varies depending on the sensitivity of the services reachable via the SSRF; at minimum, it facilitates advanced reconnaissance, and at maximum, it provides a pivot point for lateral movement within the hosting environment."
}