Description

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-04T16:17:24.200Z",
  "pubdate": "2026-09-04T16:17:24.200Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.11.2 due to a URL parser discrepancy. The vulnerability allows a remote authenticated attacker to bypass security filters and force the application to interact with internal network resources.\nThe flaw stems from inconsistent interpretation of URLs between the application's security validation logic and the underlying request handling mechanism. By exploiting this discrepancy, an attacker can coerce the server into performing unauthorized requests on their behalf, potentially accessing sensitive metadata, internal APIs, or services that are not exposed to the public network.\nThe risk implication is significant as it grants authenticated attackers the capability to conduct reconnaissance and gain access to non-public internal infrastructure. Exploitation requires the attacker to possess valid credentials to access the Langflow instance. Once authenticated, the attacker can leverage the parser flaw to mask malicious traffic, effectively circumventing environment-specific access controls. Organizations relying on Langflow in cloud environments or sensitive internal networks face elevated risks of data exfiltration and unauthorized resource interaction.",
  "technicalDetails": "The vulnerability is rooted in an 'impedance mismatch' within the URL parsing architecture of IBM Langflow OSS versions 1.0.0 through 1.11.2. The security validation layer and the back-end request execution library utilize different logic for normalizing and interpreting URI components. This discrepancy allows an attacker to craft a specially formed URL that passes the application's initial allow-list or security checks while being interpreted differently by the underlying request library (e.g., urllib or requests) during execution.\nAttack flow begins with the authenticated user interacting with a Langflow feature that consumes a user-supplied URL for external resource retrieval or workflow integration. The attacker crafts a payload utilizing URI schemes or alternative host representations (such as IPv6 address literals, decimal-encoded IPs, or unconventional port specifications) that the initial security filter fails to recognize as potentially malicious or internal.\nUpon submission, the application's front-end validator inspects the URL, determines it is safe based on the permissive parsing logic, and forwards it to the back-end service. The backend, using a stricter or differently implemented parser, resolves the input differently—often translating it into an internal network address or a sensitive local file descriptor. This effectively bypasses network segmentation controls that would otherwise restrict the server from accessing localhost or internal-only subnets.\nThis behavior facilitates Server-Side Request Forgery (SSRF). The attacker can use the server as a proxy to probe internal APIs, perform port scanning of local network services, or extract sensitive data by accessing cloud provider metadata services (e.g., http://169.254.169.254/latest/meta-data/).\nBecause the vulnerability requires authentication, the scope of the exploit is limited to users with access to the Langflow interface. However, the impact remains severe in multi-tenant environments or instances where user privileges are not granularly restricted. The post-exploitation phase involves the leakage of environment variables, configuration details, or credentials stored within the internal services, which can lead to full system compromise or lateral movement within the infrastructure. The technical root cause is an inconsistent normalization process across the request lifecycle, creating a logic gap that permits the execution of prohibited network requests."
}