CVE-2026-12765: SSRF

Q: Does exploitation require authentication?

No. The vulnerability may allow an unauthenticated attacker to cause the affected system to send unauthorized requests.

Q: What could an attacker use this vulnerability for?

It could be used for network enumeration or to facilitate other attacks by sending requests from the affected system.

Published Aug 28, 2026

Updated

Langflow is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks

Affected Software

1 affected component

IBM Langflow OSS<=1.0.0-1.10.2

Event History

Aug 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7285644

Frequently Asked Questions

Does exploitation require authentication?

No. The vulnerability may allow an unauthenticated attacker to cause the affected system to send unauthorized requests.

What could an attacker use this vulnerability for?

It could be used for network enumeration or to facilitate other attacks by sending requests from the affected system.