CVE-2026-9081: Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validatemodelproviderkey() function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).
Other sources
Langflow OSS contains a Server-Side Request Forgery (SSRF) vulnerability in the
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.0 - Compensating control
Until upgraded, prevent SSRF exploitability by blocking outbound network access from the Langflow service to loopback (127.0.0.0/8), RFC1918 private IP ranges, and link-local addresses, and (where possible) restrict egress so that requests.get() cannot reach internal resources via the user-supplied OLLAMA_BASE_URL.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9081?
The severity of CVE-2026-9081 is rated as high, with a score of 7.1.
How do I fix CVE-2026-9081?
To fix CVE-2026-9081, update IBM Langflow OSS to version 1.10.4 or later.
What type of vulnerability is CVE-2026-9081?
CVE-2026-9081 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Which versions of IBM Langflow OSS are affected by CVE-2026-9081?
IBM Langflow OSS versions 1.0.0 through 1.10.3 are affected by CVE-2026-9081.
What is the impact of CVE-2026-9081?
The impact of CVE-2026-9081 includes potential exposure of sensitive data through unauthorized API requests.