Executive brief
IBM Langflow is an application development platform that allows users to build workflows with connectors to external services. A vulnerability in URL validation allows unauthenticated attackers to forge requests to arbitrary internal and external network resources, potentially exposing sensitive data, cloud metadata, and credentials. This could lead to unauthorized access to internal systems and databases that the Langflow server can reach.
Technical details
This vulnerability is a server-side request forgery (SSRF) affecting multiple connector components in IBM Langflow OSS. The root cause is improper validation of user-supplied URLs in several areas: the MCP server configuration URL field accepts any HTTP/HTTPS target including RFC 1918 addresses and cloud metadata endpoints; the automatic tool-count check triggers outbound connections without validation; the DataStax Astra DB connector passes user-controlled API endpoints directly to the SDK without SSRF guards; the IBM Db2 Vector Store connector fetches user-controlled SSL certificate URLs without validation and is accessible through unauthenticated public endpoints; and the OpenAI Chat Model component passes user-controlled base URLs directly to underlying SDKs. An unauthenticated attacker can exploit the public flow build endpoint to craft malicious requests that return responses from arbitrary internal network resources, including sensitive data and cloud metadata. IBM recommends upgrading to version 1.11.6 or later to address this issue.
Affected products
- IBM Langflow 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed
- 2026-09-08: patched: Version 1.11.6 released