Executive brief
IBM Langflow OSS is a low-code AI workflow platform that allows users to configure API connections and data sources. Authenticated users can exploit missing or bypassable URL validation to make the Langflow server send unauthorized HTTP requests to internal network services, cloud metadata endpoints, and internal databases, potentially exposing sensitive information that should not be accessible from outside the network.
Technical details
The vulnerability is a server-side request forgery (SSRF) issue spanning multiple components. Root causes include: (1) LMStudio and embeddings components pass user-controlled base_url directly to httpx.AsyncClient without SSRF validation; (2) OpenAI-compatible model discovery issues HTTP GET requests to user-controlled base URLs with no guards and redirect-following enabled; (3) validate_url_for_ssrf is bypassable via parser divergence on backslash-containing URLs (RSSReaderSimple, SearXNGToolComponent); (4) SQL Database connector only validates hostname, not query parameters, allowing SQLAlchemy dialect overrides. The attack requires prior authentication. An attacker can probe internal services, read cloud metadata, and redirect database connections to blocked internal addresses. IBM recommends upgrading to version 1.11.3 or later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-08-28: patched: Version 1.11.3 or later available