CVE-2026-104310: Langflow: SSRF allows authenticated info disclosure

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.3 contains a server-side request forgery (CWE-918) flaw that lets any authenticated user make the server issue requests on their behalf and read back limited sensitive information. Severity is medium (CVSS 4.3, confidentiality impact low only), and there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so near-term mass exploitation looks unlikely. The real concern is where Langflow runs: on cloud hosts, SSRF can reach internal services and metadata endpoints that hold credentials for LLM providers and vector databases, so the impact depends on your network setup. Apply the fix described in the IBM advisory (ibm.com/support/pages/node/7293015), restrict Langflow account creation, and block egress from the Langflow host to internal ranges and the cloud metadata IP.

Sources:NVDATLASibm.com

What is the risk?

Medium overall. The attack is network-reachable with low complexity and needs only low privileges and no user interaction, but the CVSS impact is limited to low confidentiality with no integrity or availability effect. No exploitation evidence exists (not in KEV, no public exploit, no scanner template, EPSS unavailable). Risk rises in multi-tenant or self-service Langflow deployments, or where the host can reach cloud metadata services or internal APIs. In those cases SSRF often leads to credential theft. Treat this as a medium finding that can be escalated in poorly segmented environments.

How does the attack unfold?

Initial Access

Attacker logs in to the Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Attacker submits a crafted URL to the vulnerable feature, causing the server to send a request to an internal target.

AML.T0049

Collection

The server returns the internal response, such as metadata or service data, to the attacker.

AML.T0036

Impact

Attacker uses the leaked data or credentials to move into connected AI infrastructure.

Initial Access

Attacker logs in to the Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Attacker submits a crafted URL to the vulnerable feature, causing the server to send a request to an internal target.

AML.T0049

Collection

The server returns the internal response, such as metadata or service data, to the attacker.

AML.T0036

Impact

Attacker uses the leaked data or credentials to move into connected AI infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade IBM Langflow OSS to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Until patched, restrict Langflow access to trusted users and networks and disable open self-registration. 3) Apply egress filtering so the Langflow host cannot reach RFC1918 ranges, loopback or the cloud metadata address (169.254.169.254); enforce IMDSv2 on AWS. 4) Review outbound request logs from the Langflow host for requests to internal or metadata addresses. 5) Rotate API keys and secrets stored in Langflow if suspicious requests are found.

How is it classified?

Data ExtractionData LeakageFrameworkAPIAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104310?

Is CVE-2026-104310 actively exploited?

No confirmed active exploitation of CVE-2026-104310 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104310?

1) Upgrade IBM Langflow OSS to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Until patched, restrict Langflow access to trusted users and networks and disable open self-registration. 3) Apply egress filtering so the Langflow host cannot reach RFC1918 ranges, loopback or the cloud metadata address (169.254.169.254); enforce IMDSv2 on AWS. 4) Review outbound request logs from the Langflow host for requests to internal or metadata addresses. 5) Rotate API keys and secrets stored in Langflow if suspicious requests are found.

What systems are affected by CVE-2026-104310?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Self-hosted LLM application builders.

What is the CVSS score for CVE-2026-104310?

CVE-2026-104310 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationSelf-hosted LLM application builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

Exploitation Scenario

An attacker obtains low-privilege access to a Langflow instance, for example through a leaked or shared account or open registration. They submit a request to the vulnerable functionality with a URL pointing at the cloud metadata service or an internal admin API. The Langflow server fetches the URL and returns the response. The attacker harvests temporary cloud credentials or internal service data and uses them to reach LLM provider keys, vector databases or other connected systems.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.