Description

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-04T16:17:24.323Z",
  "pubdate": "2026-09-04T16:17:24.323Z",
  "executiveSummary": "IBM Langflow OSS, specifically versions 1.0.0 through 1.11.2, contains a Server-Side Request Forgery (SSRF) vulnerability. This security flaw allows a remote, unauthenticated attacker to manipulate the server into making unauthorized requests to internal or external resources.\nThe vulnerability originates from improper validation of user-supplied input used in network request processes within the application. By exploiting this flaw, an attacker can bypass perimeter security controls, interact with internal services that are not exposed to the public internet, or perform reconnaissance on the internal network infrastructure.\nThe impact includes the potential exposure of sensitive data, such as internal service responses, configuration details, or credentials accessible via the server's network context. The risk level is significant, as it effectively allows the server to act as a proxy for malicious requests, potentially leading to further exploitation of internal systems. No specific user interaction is required for the exploitation of this vulnerability, making it highly accessible to external threat actors targeting the Langflow environment.",
  "technicalDetails": "The vulnerability resides within the request-handling logic of IBM Langflow OSS versions 1.0.0 through 1.11.2. The root cause is the failure of the application to properly sanitize or whitelist destination URLs provided by users when the application initiates outbound HTTP requests. This deficiency allows an attacker to influence the 'target' parameter or equivalent URI-construction logic to point to unintended network locations.\nIn a standard attack flow, the attacker identifies an application feature within Langflow that performs outbound network connectivity, such as a fetch, web request, or integration hook. By injecting a crafted URL, the attacker instructs the server to initiate a request to an arbitrary destination. Because the request originates from the server itself, it bypasses network-level firewalls and access control lists (ACLs) that would typically block external access to internal administrative interfaces or private services (e.g., metadata services like 169.254.169.254, internal databases, or backend APIs).\nUpon receiving the malicious request, the underlying server-side component processes the URL without sufficient validation. This behavior results in the server acting as a proxy. The attacker can then observe the HTTP response body returned by the internal resource or infer successful communication via time-based side channels. The impact is essentially a blind or semi-blind SSRF, where the attacker gains the ability to probe the internal network's attack surface.\nThis vulnerability is particularly severe because the server's identity may be trusted by other internal services. Consequently, the attacker can leverage the server's authority to interact with sensitive APIs, potentially retrieving sensitive environmental variables, cloud provider metadata, or operational data. No authentication is required to initiate these forged requests, as the vulnerability is present in the publicly accessible ingress points of the Langflow platform. Once the SSRF is established, the attacker may perform further reconnaissance, port scanning, or attempt to exploit other internal-only services that lack robust authentication mechanisms, significantly escalating the overall compromise of the local infrastructure."
}