Description

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-04T16:17:22.650Z",
  "pubdate": "2026-09-04T16:17:22.650Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in IBM Langflow OSS versions 1.0.0 through 1.11.2.\nThis vulnerability stems from improper input validation, allowing a remote authenticated attacker to manipulate server-side requests.\nBy crafting malicious requests, an attacker can coerce the application into making unauthorized HTTP requests to internal resources, sensitive services, or external endpoints.\nThe primary risk involves the disclosure of sensitive information, potentially leading to unauthorized data access, internal network mapping, or the bypass of network-level security controls.\nSuccessful exploitation requires the attacker to be authenticated to the IBM Langflow platform.\nThis flaw poses a significant security risk to enterprise environments where Langflow may be integrated with backend services, databases, or internal APIs that are otherwise inaccessible from the public internet.",
  "technicalDetails": "The vulnerability exists within the request processing logic of IBM Langflow OSS, where the application fails to adequately sanitize or validate user-supplied URLs before passing them to internal HTTP client libraries.\nRooted in improper trust placement, the application performs requests on behalf of the user, failing to implement an allowlist of permitted destinations or sufficient protocol validation.\nThe attack flow initiates when an authenticated user supplies a crafted input parameter that forces the application to initiate a connection to an arbitrary destination.\nBecause the request originates from the server hosting the IBM Langflow instance, the application may inadvertently bypass firewall rules or Network ACLs that typically restrict access to internal infrastructure.\nAn attacker can exploit this behavior to perform port scanning against internal services, extract metadata from cloud environments (e.g., AWS/GCP instance metadata services), or interact with services bound to 'localhost' that do not require additional authentication.\nThe impact of this SSRF is primarily focused on the exfiltration of sensitive configuration data, service credentials, or administrative responses that are only accessible within the application's local network context.\nSince the vulnerability persists in versions 1.0.0 through 1.11.2, the attack surface remains open to any user with valid credentials, emphasizing the need for strict session management and internal network isolation.\nPost-exploitation, an attacker may leverage the SSRF capability to pivot further into the internal network, potentially facilitating secondary attacks against backend data stores or orchestration components that rely on the assumption of origin-based trust."
}