Langflow SSRF in URL-taking components

Severity: medium · Published 2026-10-06

Langflow is a framework for building AI workflows that includes components that fetch content from user-supplied URLs, such as RSS readers and web search tools. Before version 1.10.3, the server-side SSRF protections were disabled by default and inconsistently applied, allowing an authenticated workflow author to make the server access internal networks, loopback addresses, and cloud metadata endpoints—potentially exposing AWS, GCP, or Azure credentials.

Technologies: Langflow, Langflow-Base, Langflow Lfx, langflow (PyPI), langflow-base (PyPI). Vendors: Langflow, PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, published 6 October 2026.
Which products and versions are affected?
Langflow < 1.10.3; Langflow-Base < 0.10.3; Langflow Lfx < 1.10.3; Langflow Lfx-Docling < 0.1.2; and 4 more.
Is there a fix for This vulnerability?
Yes: fixed in langflow 1.10.3, langflow-base 0.10.3, lfx 1.10.3, lfx-docling 0.1.2. Until then: Restrict outbound network access from the Langflow host (for example, block access to 169.254.0.0/16 and use IMDSv2 on AWS). Do not disable SSRF protection via LANGFLOW_SSRF_PROTECTION_ENABLED=false; instead allowlist only necessary internal hosts using LANGFLOW_SSRF_ALLOWED_HOSTS if internal connectivity is required.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2025-10-06" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Langflow, Langflow-Base, Langflow Lfx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: langflow 1.10.3, langflow-base 0.10.3, lfx 1.10.3, lfx-docling 0.1.2

Restrict outbound network access from the Langflow host (for example, block access to 169.254.0.0/16 and use IMDSv2 on AWS). Do not disable SSRF protection via LANGFLOW_SSRF_PROTECTION_ENABLED=false; instead allowlist only necessary internal hosts using LANGFLOW_SSRF_ALLOWED_HOSTS if internal connectivity is required.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2025-10-06" } ]

Technical details

Multiple URL-fetching components (RSS Reader, SearXNG, Web Search, Home Assistant, Glean, Docling Serve) and the API Request component did not properly validate URLs before making outbound requests, and the SSRF guard was disabled by default with warn-only logging. An authenticated user could supply malicious URLs targeting private ranges, link-local addresses (169.254.x.x), or loopback to leak responses. The fix enables SSRF protection by default, validates and pins requests to resolved IPs to prevent DNS rebinding, and blocks access to private/metadata addresses unless explicitly allowlisted.

Affected products

  • Langflow langflow < 1.10.3
  • Langflow langflow-base < 0.10.3
  • Langflow lfx < 1.10.3
  • Langflow lfx-docling < 0.1.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.