CVE-2026-12766: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
Published Aug 28, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Affected Software
1 affected component
IBM Langflow OSS<=1.0.0-1.11.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.3
Event History
Aug 28, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 14, 2026
CVE Published
via MITRE·08:29 PM
Data Sourced
via MITRE·08:29 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require prior access to Langflow?
Yes. The issue is described as requiring an authenticated attacker, so unauthenticated access alone is not identified as sufficient for exploitation.