Executive brief
IBM Langflow Desktop, a tool used for building AI workflows, is vulnerable to a security flaw that allows authenticated users to bypass network restrictions. An attacker can trick the system into making unauthorized requests to internal services or cloud metadata endpoints that should be private. This could lead to the exposure of sensitive internal data or allow an attacker to map out the organization's private network.
Technical details
IBM Langflow Desktop (versions 1.0.0 through 1.9.2) contains a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in its SSRF protection mechanism. The 'validate_url_for_ssrf()' function performs a DNS lookup to validate an IP, but the subsequent request via 'httpx.AsyncClient()' performs a second, independent lookup. An attacker can use a DNS rebinding attack with a TTL of 0 to provide a safe IP during validation and a private/local IP (such as 127.0.0.1 or cloud metadata IPs) during execution. While DNS pinning infrastructure exists in the codebase, it is not consistently applied across all code paths. This allows authenticated attackers to perform network enumeration or access internal services. The issue is resolved in version 1.9.3.
Affected products
- IBM Langflow Desktop 1.0.0 - 1.9.2
Timeline
- 2026-06-08: advisory: Initial publication by IBM
- 2026-06-11: disclosed: NVD publication date