Executive brief
IBM Langflow OSS is an open-source framework for building AI applications using visual workflows. A URL parser flaw allows authenticated users to bypass security checks and send requests to internal services, cloud metadata endpoints, and databases that should be blocked. An attacker with valid credentials can probe internal networks and read sensitive information, potentially exposing configuration data, credentials, or other confidential resources.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in IBM Langflow OSS caused by a URL parser discrepancy in SSRF validation logic. The vulnerability affects multiple components including RSSReaderSimple and SearXNGToolComponent, where backslash-containing URLs bypass the validate_url_for_ssrf guard. An authenticated attacker can craft URLs that pass validation but resolve to private IP addresses or internal services due to parser divergence between the validation layer and the HTTP client (httpx). Exploiting this allows an attacker to probe and exfiltrate data from internal services, cloud metadata endpoints, and internal databases reachable from the Langflow server. IBM recommends upgrading to version 1.11.3 or later; no workarounds are available.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-08-28: patched: Fix available in version 1.11.3