CVE-2026-102590: Langflow: SSRF allows authenticated info disclosure

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery flaw that lets any authenticated user make the server issue requests on their behalf and read back sensitive information. Severity is medium (CVSS 5.0), but the scope is changed (S:C), meaning the server can be used to reach internal resources beyond Langflow itself, such as cloud metadata endpoints and internal APIs. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so exploitation is not currently observed, but SSRF in flow-building platforms is a well-understood and easily weaponized class. Review IBM's advisory and upgrade beyond 1.12.3 to the fixed release, and until then restrict Langflow account creation, block egress to metadata IPs (169.254.169.254) and internal ranges, and enforce IMDSv2 on cloud hosts.

Sources:NVDibm.comATLAS

What is the risk?

Medium overall. Exploitation is network-based, low complexity, needs only low privileges and no user interaction. Confidentiality impact is low but scope is changed, so the blast radius depends on what the Langflow host can reach (cloud metadata, internal services, vector databases, LLM provider gateways). No evidence of active exploitation, public exploit code, or KEV listing as of publication. EPSS is not yet available. Risk rises sharply for internet-exposed instances with open registration or shared multi-tenant deployments.

How does the attack unfold?

Initial Access

Attacker gains a low-privileged authenticated Langflow account via open registration or stolen credentials.

AML.T0049

Exploitation

Attacker submits a crafted URL so the Langflow server issues a request to an internal or metadata endpoint (SSRF).

AML.T0049

Collection

Server returns the internal response, exposing sensitive data such as cloud credentials or internal service details.

AML.T0036

Impact

Attacker uses harvested data to pivot to connected AI infrastructure, such as vector databases, storage and LLM provider accounts.

Initial Access

Attacker gains a low-privileged authenticated Langflow account via open registration or stolen credentials.

AML.T0049

Exploitation

Attacker submits a crafted URL so the Langflow server issues a request to an internal or metadata endpoint (SSRF).

AML.T0049

Collection

Server returns the internal response, exposing sensitive data such as cloud credentials or internal service details.

AML.T0036

Impact

Attacker uses harvested data to pivot to connected AI infrastructure, such as vector databases, storage and LLM provider accounts.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Langflow to the fixed version referenced in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); the fix is above 1.12.3. 2) Until patched, restrict Langflow accounts to trusted users and disable open sign-up. 3) Apply egress filtering on the Langflow host/container to deny access to link-local (169.254.169.254), loopback and RFC1918 ranges except explicitly required services. 4) Enforce IMDSv2 or equivalent metadata protections and use least-privilege cloud roles for the workload. 5) Detection: alert on outbound requests from Langflow to internal or metadata addresses, and review application logs for flows or API calls containing unusual URLs from low-privileged users.

How is it classified?

Data ExtractionData LeakageFrameworkAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-102590?

Is CVE-2026-102590 actively exploited?

No confirmed active exploitation of CVE-2026-102590 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-102590?

1) Upgrade Langflow to the fixed version referenced in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); the fix is above 1.12.3. 2) Until patched, restrict Langflow accounts to trusted users and disable open sign-up. 3) Apply egress filtering on the Langflow host/container to deny access to link-local (169.254.169.254), loopback and RFC1918 ranges except explicitly required services. 4) Enforce IMDSv2 or equivalent metadata protections and use least-privilege cloud roles for the workload. 5) Detection: alert on outbound requests from Langflow to internal or metadata addresses, and review application logs for flows or API calls containing unusual URLs from low-privileged users.

What systems are affected by CVE-2026-102590?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow builders, RAG pipelines, agent frameworks, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-102590?

CVE-2026-102590 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

LLM workflow buildersRAG pipelinesagent frameworksmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

Exploitation Scenario

An attacker obtains or registers a low-privileged Langflow account, for example on an instance with self-registration or via a phished user. They create or modify a flow with a component that fetches a URL, or call the vulnerable endpoint directly, pointing it at http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal admin service. Langflow's server performs the request and returns the response, exposing temporary cloud credentials or internal data. The attacker then uses those credentials to pivot to storage buckets, vector databases or LLM provider accounts connected to the AI platform.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.