Description

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T21:17:00.713Z",
  "pubdate": "2026-09-14T21:17:00.713Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This security flaw originates from improper input validation when the application processes external requests, allowing an authenticated attacker to manipulate the server into initiating unauthorized network interactions.\nThe impact of this vulnerability is significant, as it enables an attacker to bypass network perimeter defenses. By leveraging the application server as a proxy, a malicious actor can perform internal network enumeration, discover non-public services, and interact with internal APIs or metadata services that are otherwise unreachable from the public internet.\nSuccessful exploitation requires the attacker to hold an authenticated session within the Langflow environment. Once authenticated, the attacker can supply crafted inputs to vulnerable functions, forcing the application to perform requests to arbitrary destinations, including local loopback addresses (127.0.0.1) or sensitive internal infrastructure.\nThe risk implications include potential data exfiltration from internal services, unauthorized execution of administrative functions within the local network, and the facilitation of further exploitation chains. Organizations should prioritize updating to a remediated version if available or implementing strict egress filtering to limit the server's network reach.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) flaw residing within the request handling mechanisms of IBM Langflow OSS versions 1.0.0 through 1.11.2. The root cause is the failure of the application to adequately sanitize or restrict the destination parameters provided by a user before passing them to internal HTTP request library functions.\nIn the context of the application architecture, specific components designed to interact with external data sources or endpoints do not implement a robust allowlist for target hosts or protocols. When a user submits an endpoint configuration—such as a URL for a data fetcher or a custom integration—the application fails to validate the request destination against known safe domains. This enables an attacker to supply URLs pointing to internal infrastructure or restricted network segments.\nThe attack flow proceeds as follows: First, an authenticated attacker identifies a feature within Langflow that performs a server-side fetch based on a user-supplied URL. Second, the attacker crafts a malicious request by modifying this URL to target an internal resource, such as 'http://localhost:6379' (for Redis services) or 'http://169.254.169.254' (in cloud environments to extract metadata). Third, the application's back-end process blindly honors the request, utilizing its own identity and network position to execute the call.\nThe lack of protocol restriction further exacerbates the issue, potentially allowing attackers to initiate requests via protocols other than HTTP/HTTPS if the underlying library supports them, which could lead to interactions with non-HTTP internal services. Because the request originates from the application server itself, it inherently possesses access to internal subnets, bypassing firewalls and Network Access Control Lists (ACLs) that would otherwise block direct external traffic to these assets.\nPost-exploitation, the attacker can analyze the responses returned by the application to map the internal network topology, identify active services, and detect service versions. In certain scenarios, if the internal services do not require secondary authentication, the attacker can perform unauthorized state-changing operations, such as modifying configuration or extracting sensitive credentials stored within the local environment, effectively escalating their privileges and deepening their foothold within the infrastructure."
}