Executive brief
IBM Langflow OSS is a flow-based application platform that allows users to build and execute workflows. Multiple flow components (LM Studio, Home Assistant, DeepSeek, Ollama, and others) accept user-supplied URLs and make server-side HTTP requests without proper validation, allowing an authenticated attacker to reach internal services, cloud metadata endpoints, or administrative interfaces. An attacker could exploit this to extract sensitive information from internal systems or cloud metadata services.
Technical details
This is a server-side request forgery (SSRF) vulnerability (CWE-918) caused by missing URL validation in flow components that perform outbound HTTP requests. Multiple components (LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve) accept user-supplied URLs without applying Langflow's existing SSRF protection utilities. The Docling Serve component additionally bypasses SSRF protection even when LANGFLOW_SSRF_PROTECTION_ENABLED is enabled. An authenticated attacker can reach arbitrary internal or external network destinations through standard authenticated flow execution and component configuration API endpoints, with response content potentially disclosed through component output or error messages. The vulnerability is non-blind SSRF allowing information disclosure. A fix is available in version 1.10.3.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.2
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix available in version 1.10.3