Executive brief
IBM Langflow OSS is an open-source framework for building multi-agent AI applications. Versions 1.0.0 through 1.11.5 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the public flow build endpoint that allows attackers to make unauthorized HTTP requests from the server. An attacker can exploit this to enumerate internal networks, access cloud metadata services, or relay requests to facilitate further attacks.
Technical details
CVE-2026-12767 is a server-side request forgery vulnerability in IBM Langflow OSS caused by missing egress validation on server-side URL fetches. Multiple components are affected: the OpenAI Chat Model component and IBM Db2 Vector Store connector accept user-controlled URLs and pass them directly to underlying SDKs without SSRF validation, and both are accessible through the unauthenticated public flow build endpoint. The vulnerability requires no authentication or user interaction; an attacker can send a crafted request specifying an arbitrary URL to exfiltrate data, access internal resources (RFC 1918 addresses, loopback, cloud metadata), or relay API keys to attacker-controlled hosts. IBM released version 1.11.6 as a fix.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.5
Timeline
- 2026-09-14: disclosed
- 2026-09-08: patched: Version 1.11.6 fixes the vulnerability