Executive brief
IBM Langflow OSS is an open-source AI workflow platform that allows users to build and configure data pipelines and integrations. The platform fails to properly validate user-supplied API endpoint URLs, allowing authenticated attackers to trigger server-side requests to arbitrary internal or external targets. An attacker could exploit this to access sensitive information from internal networks, exfiltrate API credentials, or facilitate further network attacks.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw stemming from improper validation of user-controlled API endpoint URLs in multiple components, including the MCP server configuration, DataStax Astra DB connectors, IBM Db2 Vector Store connector, and OpenAI Chat Model components. Affected versions 1.0.0–1.11.5 pass these URLs directly to underlying SDKs without invoking the platform's connector SSRF validation guard. An authenticated attacker can supply URLs pointing to RFC 1918 addresses, loopback interfaces, or cloud metadata endpoints; some components (Db2, OpenAI) are also reachable via the unauthenticated public flow build endpoint, broadening the attack surface. Successful exploitation allows data exfiltration (including provider API keys) and internal network reconnaissance. The vulnerability was patched in version 1.11.6.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Version 1.11.6 addresses the vulnerability