Executive brief
IBM Langflow OSS is a low-code platform for building AI applications. Versions 1.0.0 through 1.11.2 contain multiple server-side request forgery (SSRF) vulnerabilities that allow unauthenticated remote attackers to probe and extract sensitive information from internal networks, cloud metadata services, and databases accessible from the Langflow server. An attacker can exploit missing or bypassable URL validation in several components to redirect requests to internal network hosts and read their responses.
Technical details
The vulnerability is a server-side request forgery (CWE-918) affecting multiple Langflow components with missing or insufficient URL validation. The LMStudio and OpenAI-compatible model discovery components pass user-controlled base URLs directly to HTTP clients without SSRF validation. Additional SSRF guards in the RSSReaderSimple and SearXNGToolComponent can be bypassed through URL parser discrepancies with backslash-encoded URLs. The SQL Database connector validates only hostname in the netloc but not query parameters, allowing SQLAlchemy dialect overrides to redirect connections to internal addresses. An unauthenticated attacker can supply crafted URLs or database connection strings to probe and read responses from internal services, cloud metadata endpoints, and internal databases. Langflow OSS should be upgraded to version 1.11.3 or later to remediate these issues.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-09-04: disclosed
- 2026-08-28: patched: Security bulletin published; upgrade to version 1.11.3 recommended