Executive brief
IBM Langflow OSS is a low-code platform for building AI applications with reusable components. An unauthenticated attacker can exploit missing URL validation in flow components to send unauthorized requests from the Langflow server to internal systems, cloud metadata services, or external networks. This could enable network reconnaissance, data exfiltration from internal services, or facilitate attacks on backend infrastructure.
Technical details
Langflow OSS contains a server-side request forgery (SSRF) vulnerability in flow components such as LM Studio, Home Assistant, DeepSeek, Ollama, and others that accept user-supplied URL values and issue outbound HTTP requests without proper validation. The vulnerability exists because these components bypass Langflow's existing SSRF protection utilities, and notably the Docling Serve component bypasses protection even when LANGFLOW_SSRF_PROTECTION_ENABLED is enabled. An unauthenticated attacker can reach arbitrary internal or external destinations including cloud metadata services and loopback-bound administrative interfaces; response content from internal services may be disclosed through component output or error messages. The vulnerability is exploitable through standard flow execution and component configuration API endpoints. A patch is available in version 1.10.3 and later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.2
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fixed in version 1.10.3