CVE-2026-104315: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Other sources
Langflow oSS is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS 1.12.4.
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are affected. Version 1.12.4 is identified as the upgrade target.
What access does an attacker need?
The attack vector is network-accessible, but the attacker must be authenticated and have low-level privileges. No user interaction is required.
What can successful exploitation enable?
An attacker may cause the Langflow system to send unauthorized requests. This could support network enumeration or facilitate further attacks against reachable services.
What should teams do to remediate the issue?
Upgrade Langflow OSS to version 1.12.4. For affected installations, back up the existing deployment, follow the applicable upgrade preparation and release-specific configuration changes, install 1.12.4, and test flows.