Description

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-04T17:16:55.507Z",
  "pubdate": "2026-09-04T17:16:55.507Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability has been identified in IBM Langflow OSS, affecting versions 1.0.0 through 1.10.2.\nThis flaw enables a remote authenticated attacker to coerce the application into making unauthorized requests to internal resources or external services.\nThe vulnerability poses a significant risk to the confidentiality and integrity of internal network architecture, as it allows attackers to bypass perimeter security controls, interact with local services that are otherwise unreachable from the internet, and potentially exfiltrate sensitive data.\nSuccessful exploitation requires the attacker to hold valid authentication credentials to the IBM Langflow platform.\nThe risk implication centers on the potential for unauthorized internal discovery and exploitation of backend services or metadata endpoints.",
  "technicalDetails": "The vulnerability resides in the request handling mechanisms within IBM Langflow OSS versions 1.0.0 through 1.10.2, where user-supplied input is not sufficiently validated or sanitized before being used to initiate outbound HTTP requests from the server.\nThis SSRF vulnerability functions by allowing an authenticated user to specify or manipulate a target URL parameter processed by the server's backend, effectively turning the application into a proxy for malicious requests.\nThe attack flow begins with the attacker identifying an endpoint that performs server-side data fetching or proxying. By injecting a crafted URI pointing to internal IP addresses (e.g., 127.0.0.1, 169.254.169.254 for cloud metadata services, or internal network services), the attacker forces the IBM Langflow server to perform a request on their behalf.\nBecause these requests originate from the application server, they often bypass firewall rules, access control lists (ACLs), or network segmentation policies that would otherwise prevent direct access from the external attacker's host.\nThe root cause is the lack of a robust allowlist or blocklist mechanism for outbound requests, coupled with insufficient input validation. The application fails to verify the scheme, host, or port of the destination before initiating the connection.\nExploitation allows the attacker to interact with internal management consoles, API endpoints, or services that rely on implicit trust for requests originating from 'localhost' or the internal network segment. In cloud-hosted environments, this is particularly dangerous as it may enable the exfiltration of sensitive instance metadata, potentially leaking cloud credentials, configuration secrets, or system environment variables.\nPost-exploitation, an attacker may conduct internal network reconnaissance, perform service-specific operations against internal APIs, or pivot further into the infrastructure by exploiting other services that trust the origin of the IBM Langflow application server.\nThe vulnerability is limited to the server-side environment where Langflow is hosted and does not directly provide remote code execution, although the information obtained through the SSRF can be leveraged to achieve higher levels of compromise in secondary systems."
}