CVE-2026-102590: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
Other sources
Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS 1.12.4.
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to exploit the SSRF vulnerability. The provided data does not indicate that unauthenticated users can exploit it.
Which versions are known to be affected?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are identified as affected.
What is the expected impact of successful exploitation?
Successful exploitation could allow an authenticated remote attacker to obtain sensitive information. The provided data does not identify the specific internal services, endpoints, or data sources that may be reachable.