CVE-2026-12766: SSRF

Q: Does exploitation require prior access to Langflow?

Yes. The issue is described as requiring an authenticated attacker, so unauthenticated access alone is not identified as sufficient for exploitation.

Published Aug 28, 2026

Updated

Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks

Affected Software

1 affected component

IBM Langflow OSS<=1.0.0-1.11.2

Event History

Aug 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7285639

Frequently Asked Questions

Does exploitation require prior access to Langflow?

Yes. The issue is described as requiring an authenticated attacker, so unauthenticated access alone is not identified as sufficient for exploitation.