Executive brief
IBM Langflow OSS, a tool used for building AI applications, contains a security flaw in how it handles web requests. An authorized user with basic access can bypass security restrictions to reach internal systems and private data that should be protected. This could allow an attacker to steal sensitive information like credentials, tokens, or internal company data by tricking the system into accessing restricted internal addresses.
Technical details
A Server-Side Request Forgery (SSRF) bypass exists in the API Request component of IBM Langflow OSS. The vulnerability occurs because the 'make_api_request()' function validates only the initial URL provided by the user but fails to re-validate subsequent destinations when HTTP redirects are followed. An authenticated attacker with the 'flow author' role can exploit this by enabling the 'follow_redirects' parameter and providing a public URL that redirects to internal or localhost addresses (e.g., 127.0.0.1 or cloud metadata services). This allows the attacker to bypass 'LANGFLOW_SSRF_PROTECTION_ENABLED' controls to retrieve sensitive internal information. The issue is addressed in Langflow OSS version 1.10.0.
Affected products
- IBM Langflow OSS 1.0.0 through 1.9.3
Timeline
- 2026-06-23: advisory: Initial publication by IBM
- 2026-06-30: disclosed: NVD publication date
- 2026-06-23: patched: Version 1.10.0 released to address the vulnerability