CVE-2026-81265: Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
Published Sep 8, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.11.5.
Affected Software
1 affected component
IBM Langflow OSS<=1.0.0-1.11.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.6
Event History
Sep 8, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
Affected Software
Sep 10, 2026
CVE Published
via MITRE·09:31 PM
Data Sourced
via MITRE·09:31 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be treated as affected?
IBM Langflow OSS versions 1.0.0 through 1.11.5 are listed as affected. Verify the deployed Langflow OSS version to determine whether it falls within this range.
2
Does exploitation require an authenticated account or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the expected security impact?
The reported impact is high confidentiality impact, with no integrity or availability impact indicated in the CVSS vector.