# CVE-2026-81213: IBM Langflow server-side request forgery in URL validation

Source: https://junglewise.ai/threats/cve-2026-81213-ibm-langflow-server-side-request-forgery-in-url-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81213 · Severity: high · CVSS 8.6 · Published 2026-09-10

IBM Langflow is an application development platform that allows users to build workflows with connectors to external services. A vulnerability in URL validation allows unauthenticated attackers to forge requests to arbitrary internal and external network resources, potentially exposing sensitive data, cloud metadata, and credentials. This could lead to unauthorized access to internal systems and databases that the Langflow server can reach.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow).

## Quick answers

**Is CVE-2026-81213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81213 being exploited in the wild.

**How severe is CVE-2026-81213?** High severity, with a CVSS score of 8.6, published 10 September 2026.

**Which products and versions are affected?** IBM Langflow 1.0.0 through 1.11.5.

**Is there a fix for CVE-2026-81213?** A patch was published on 2026-09-08: Version 1.11.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81213 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81213?** Check whether you run Langflow. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a server-side request forgery (SSRF) affecting multiple connector components in IBM Langflow OSS. The root cause is improper validation of user-supplied URLs in several areas: the MCP server configuration URL field accepts any HTTP/HTTPS target including RFC 1918 addresses and cloud metadata endpoints; the automatic tool-count check triggers outbound connections without validation; the DataStax Astra DB connector passes user-controlled API endpoints directly to the SDK without SSRF guards; the IBM Db2 Vector Store connector fetches user-controlled SSL certificate URLs without validation and is accessible through unauthenticated public endpoints; and the OpenAI Chat Model component passes user-controlled base URLs directly to underlying SDKs. An unauthenticated attacker can exploit the public flow build endpoint to craft malicious requests that return responses from arbitrary internal network resources, including sensitive data and cloud metadata. IBM recommends upgrading to version 1.11.6 or later to address this issue.

## Affected products

- IBM Langflow 1.0.0 through 1.11.5

## Timeline

- 2026-09-10: disclosed
- 2026-09-08: patched: Version 1.11.6 released

## References

- [https://www.ibm.com/support/pages/node/7286665](https://www.ibm.com/support/pages/node/7286665)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow unsafe eval() in schema.py code execution](https://junglewise.ai/threats/cve-2026-101861-langflow-1-0-16-before-1-12-0-and-0-0-94-before-1-12-0-contain)
- [IBM Langflow OSS path traversal arbitrary file write](https://junglewise.ai/threats/cve-2026-84889-ibm-langflow-oss-path-traversal-arbitrary-file-write)