CVE-2026-12765: Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Other sources
Langflow is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.3
Event History
Frequently Asked Questions
Does exploitation require authentication?
No. The vulnerability may allow an unauthenticated attacker to cause the affected system to send unauthorized requests.
What could an attacker use this vulnerability for?
It could be used for network enumeration or to facilitate other attacks by sending requests from the affected system.