CVE-2026-104331: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Other sources
Langflow OSS is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS 1.12.4.
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are identified as vulnerable. The available information does not state whether any particular configuration or deployment mode is exempt.
What access does an attacker need to exploit this issue?
An attacker must be authenticated and able to reach the vulnerable Langflow OSS instance over the network. No user interaction is required.
What could an attacker do after exploiting it?
The attacker may cause the Langflow OSS system to send unauthorized requests. This could enable network enumeration or help facilitate additional attacks against resources reachable from the affected system.