CVE-2026-104310: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
Other sources
Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.4.
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are identified as affected. Deployments using those versions should be prioritized, particularly where authenticated users can interact with functionality that may issue server-side requests.
What access does an attacker need to exploit this issue?
The attacker must be remotely authenticated and have low-level privileges. No user interaction is required.