CVE-2026-10564: SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), potentially exfiltrating IAM credentials and enumerating internal networks. The vulnerability can also be triggered through prompt injection in agentic workflows due to toolmode=True exposure.
Other sources
Langflow OSS contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.0 - Configuration
Mitigate SSRF trigger via prompt injection by avoiding/disable tool_mode=True exposure in agentic workflows that can call tools using user-controlled URLs.
Langflow OSS agentic workflows tool_mode = True
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10564?
The severity of CVE-2026-10564 is rated high with a CVSS score of 8.2.
How do I fix CVE-2026-10564?
To fix CVE-2026-10564, upgrade to IBM Langflow OSS version 1.9.7 or later, where the SSRF vulnerability is addressed.
What components are affected by CVE-2026-10564?
CVE-2026-10564 affects the legacy RSSReaderComponent in rss.py and the SearXNG component in searxng.py.
Who can exploit CVE-2026-10564?
An authenticated attacker can exploit CVE-2026-10564 by sending unvalidated HTTP requests to user-controlled URLs.
What type of vulnerability is CVE-2026-10564?
CVE-2026-10564 is classified as a Server-Side Request Forgery (SSRF) vulnerability.