CVE-2026-104315: Langflow: SSRF allows authenticated internal network probing

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.3 contains a server-side request forgery flaw that lets any authenticated user make the Langflow server send requests to destinations of their choosing. Severity is medium (CVSS 4.3) with limited confidentiality impact. There is no public exploit, no Nuclei template, no CISA KEV listing and no EPSS score yet, so near-term exploitation likelihood looks low. The real exposure is in cloud deployments, where an SSRF from an AI orchestration host can reach internal services or metadata endpoints, and where Langflow often holds LLM API keys and database credentials. Apply the fix from the IBM advisory (node 7293015), restrict Langflow user accounts to trusted staff, and block egress from the Langflow host to internal ranges and cloud metadata addresses.

Sources:NVDibm.comATLAS

What is the risk?

Medium risk. The attack is network-reachable with low complexity and needs no user interaction, but it requires a valid low-privilege account and the confidentiality impact is low, with no integrity or availability impact. No public exploit, scanner template, KEV listing or EPSS data was available at publication. Risk rises in multi-tenant or internet-exposed Langflow instances with open self-registration, and in cloud environments where the host can reach metadata services or internal admin interfaces. Confidence: MEDIUM, since the description is brief and the exact vulnerable component is not named.

How does the attack unfold?

Initial Access

Attacker authenticates to Langflow with a low-privilege account obtained through credential theft or open registration.

AML.T0012

Exploitation

Attacker supplies a crafted URL to a vulnerable Langflow function so the server issues requests on their behalf.

AML.T0049

Discovery

Attacker maps internal hosts, ports and cloud metadata endpoints reachable from the Langflow server.

AML.T0006

Impact

Attacker reads limited internal data or credentials and uses them to pivot toward other AI infrastructure.

Initial Access

Attacker authenticates to Langflow with a low-privilege account obtained through credential theft or open registration.

AML.T0012

Exploitation

Attacker supplies a crafted URL to a vulnerable Langflow function so the server issues requests on their behalf.

AML.T0049

Discovery

Attacker maps internal hosts, ports and cloud metadata endpoints reachable from the Langflow server.

AML.T0006

Impact

Attacker reads limited internal data or credentials and uses them to pivot toward other AI infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015). 2) Until patched, limit Langflow accounts to trusted users and disable open self-registration. 3) Apply egress filtering on the Langflow host to deny access to RFC1918 ranges, loopback and cloud metadata endpoints (169.254.169.254), and enforce IMDSv2 on cloud instances. 4) Run Langflow in an isolated network segment with only the required connections to model providers and data stores. 5) Detect abuse by reviewing Langflow and proxy logs for unusual outbound requests to internal addresses or sequential port and host probing from authenticated sessions. 6) Rotate credentials stored in Langflow if suspicious outbound activity is found.

How is it classified?

Data LeakageData ExtractionFrameworkAPIAML.T0006- Active Scanning AML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and mechanisms to supersede or deactivate systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104315?

Is CVE-2026-104315 actively exploited?

No confirmed active exploitation of CVE-2026-104315 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104315?

1) Upgrade Langflow OSS to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015). 2) Until patched, limit Langflow accounts to trusted users and disable open self-registration. 3) Apply egress filtering on the Langflow host to deny access to RFC1918 ranges, loopback and cloud metadata endpoints (169.254.169.254), and enforce IMDSv2 on cloud instances. 4) Run Langflow in an isolated network segment with only the required connections to model providers and data stores. 5) Detect abuse by reviewing Langflow and proxy logs for unusual outbound requests to internal addresses or sequential port and host probing from authenticated sessions. 6) Rotate credentials stored in Langflow if suspicious outbound activity is found.

What systems are affected by CVE-2026-104315?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, low-code AI workflow builders.

What is the CVSS score for CVE-2026-104315?

CVE-2026-104315 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, through a phished credential or an open signup. They build or edit a flow, or call an API endpoint, that fetches a URL they control and point it at internal addresses. By watching response differences and timing, they enumerate internal hosts and ports, then request the cloud metadata service or an unauthenticated internal admin API. Any data returned, such as instance credentials, can then be used to move laterally toward vector databases, model endpoints or other AI infrastructure.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.