Description

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T21:17:00.847Z",
  "pubdate": "2026-09-14T21:17:00.847Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.5 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This security flaw allows unauthenticated remote attackers to force the application to perform arbitrary HTTP requests to internal or external resources.\nThe vulnerability exists due to insufficient validation of user-supplied input when the application processes network-bound operations. By crafting malicious requests, an attacker can interact with services residing within the internal network that are otherwise protected by perimeter firewalls.\nThe impact includes potential network enumeration, discovery of internal services, and the ability to bypass network access controls. In certain configurations, this may lead to further exploitation by interacting with local services or metadata endpoints. Given the lack of authentication requirements, the risk is significant, as attackers can leverage the application's hosting environment as a proxy for malicious activity, potentially exfiltrating internal data or executing commands on vulnerable internal systems reachable from the application server.",
  "technicalDetails": "The SSRF vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.11.5) stems from improper input sanitization within the application's request-handling logic. The application fails to adequately validate or restrict the target URLs provided during specific operational tasks, allowing users to specify arbitrary destination addresses for outbound HTTP requests.\nThe attack flow begins when an attacker identifies an endpoint or component within IBM Langflow that facilitates outbound network requests, such as those used for fetching configurations, resources, or integrating external data sources. Instead of providing the expected legitimate URL, the attacker submits a request containing a target URL pointing to an internal IP address (e.g., 127.0.0.1) or an internal network resource (e.g., 10.x.x.x or 192.168.x.x).\nUpon receiving the payload, the application component responsible for executing the network request fails to verify the target hostname or IP range against a blacklist or whitelist. Consequently, the application initiates an outbound connection from the host server to the specified internal or external target. Because the request originates from the server environment, it often bypasses perimeter firewalls, NAT configurations, and local access control lists (ACLs) that would otherwise prohibit external access to these internal services.\nThe exploitation process does not require authentication, significantly lowering the barrier for entry. Once the connection is established, the application may reflect information back to the attacker or silently perform the requested action. This allows an attacker to conduct reconnaissance by scanning internal ports, banner grabbing from internal services, or interacting with cloud metadata services (e.g., 169.254.169.254) to potentially retrieve sensitive instance information, tokens, or security credentials.\nFurthermore, the post-exploitation impact includes the potential to leverage the SSRF as a pivot point. If an internal service relies on IP-based authentication or is otherwise vulnerable to unauthenticated requests, the attacker can use the IBM Langflow instance to compromise these backend systems. The lack of strict protocol enforcement may also allow attackers to use other protocols supported by the underlying request library (e.g., file:// or gopher://), potentially leading to file disclosure or arbitrary command execution on the host server depending on the specific implementation of the network request handler."
}