Executive brief
IBM Langflow OSS, a tool used for building and testing AI applications, contains a security flaw that could allow an authorized user to trick the server into making unauthorized requests. This could lead to the exposure of sensitive internal data, such as cloud service credentials or internal network information. Organizations using affected versions should upgrade to version 1.10.1 to ensure protection mechanisms are enabled by default.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw is rooted in the 'ssrf_protection_enabled' setting, which was set to 'False' by default, and an incomplete enforcement of URL validation. An authenticated attacker with network access can exploit this to force the server to fetch arbitrary URLs, potentially accessing sensitive cloud metadata endpoints (169.254.169.254), internal services, or Docker daemon APIs. The issue has been addressed in version 1.10.1 by changing the default protection setting to 'True' in the security configuration.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.0
Timeline
- 2026-07-02: advisory: Initial publication by IBM
- 2026-07-17: disclosed: NVD publication date