Quick answers
- Is CVE-2026-3340 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3340 being exploited in the wild.
- How severe is CVE-2026-3340?
- Medium severity, with a CVSS score of 6.5, published 30 April 2026.
- Which products and versions are affected?
- IBM Langflow Desktop 1.0.0 - 1.8.4.
- Is there a fix for CVE-2026-3340?
- A patch was published on 2026-04-28: Version 1.9.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-3340 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-3340?
- Check whether you run IBM Langflow Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the URL data source component of IBM Langflow Desktop versions 1.0.0 through 1.8.4. The root cause is insufficient validation of user-supplied URLs before they are processed by the backend HTTP request handler. An authenticated attacker can exploit this to force the application to perform requests to internal or restricted network resources, including localhost services, private IP ranges, and cloud metadata endpoints. This can be used for network enumeration or to retrieve sensitive data from internal systems by relaying responses back through the Langflow execution flow. The vulnerability is addressed in version 1.9.0.
Affected products
- IBM Langflow Desktop 1.0.0 - 1.8.4
Timeline
- 2026-04-28: disclosed: Initial publication by IBM
- 2026-04-30: advisory: NVD publication date
- 2026-04-28: patched: Version 1.9.0 released to address the issue