Executive brief
IBM Langflow, a tool for building AI applications, contains multiple server-side request forgery (SSRF) vulnerabilities that allow authenticated users to craft malicious requests appearing to come from the Langflow server itself. An attacker could use these vulnerabilities to access internal databases, probe private networks, or reach cloud metadata endpoints that should not be directly accessible, potentially compromising sensitive data and infrastructure.
Technical details
Langflow OSS versions 1.0.0 through 1.11.2 contain multiple SSRF vulnerabilities stemming from insufficient URL validation across several components: LMStudio and embeddings models pass user-controlled base_url directly to httpx.AsyncClient without SSRF validation; OpenAI-compatible model discovery issues unguarded HTTP GET requests to user-controlled URLs with redirect-following; the validate_url_for_ssrf function can be bypassed via parser divergence in backslash-containing URLs on RSSReaderSimple and SearXNG components; and the SQL Database connector only validates the hostname but not query parameters, allowing SQLAlchemy dialect overrides to redirect connections to internal addresses. Authentication is required to exploit most variants, but the attack vector is network-accessible. Successful exploitation enables probing and reading from internal network services, cloud metadata endpoints, and internal databases. IBM released version 1.11.3 with fixes and provides no workarounds.
Affected products
- IBM Langflow 1.0.0 through 1.11.2
Timeline
- 2026-08-28: disclosed
- 2026: patched: Version 1.11.3 addresses the vulnerabilities