Executive brief
IBM Langflow OSS is an open-source platform for building AI workflows. It contains multiple server-side request forgery (SSRF) vulnerabilities that allow attackers to make unauthorized outbound requests from the server to internal networks, cloud metadata services, or attacker-controlled hosts. Exploits could leak sensitive API keys, enumerate internal resources, or facilitate further network attacks.
Technical details
CVE-2026-81265 is one of four related SSRF vulnerabilities in Langflow OSS 1.0.0–1.11.5 stemming from missing or inconsistent egress validation on server-side URL fetches. The OpenAI Chat Model component and other connectors (DataStax Astra DB, IBM Db2) accept user-controlled URLs without applying the platform's SSRF guard, and some are reachable via unauthenticated public flow build endpoints. An attacker can supply RFC 1918, loopback, or cloud metadata addresses to trigger outbound requests; in some cases, the server forwards operator API keys to the attacker's host. The vulnerability requires no user interaction and network reachability to the Langflow server. IBM recommends upgrading to version 1.11.6 or later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.5
Timeline
- 2026-09-08: disclosed: IBM security bulletin published
- 2026-09: patched: Fixed in version 1.11.6