CVE-2026-104331: Langflow: SSRF allows authenticated internal requests

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (CWE-918) flaw that lets any authenticated user make the Langflow server send requests on their behalf, enabling internal network enumeration and follow-on attacks. The severity is medium (CVSS 5.4), and there is no sign of active exploitation: it is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS and SSVC data are not yet available. The risk is higher than the score suggests when Langflow runs in cloud environments, where SSRF can reach metadata services and internal APIs that hold credentials, and Langflow has a history of being targeted by attackers. Upgrade to the fixed release referenced in the IBM advisory (https://www.ibm.com/support/pages/node/7293015), restrict egress traffic from Langflow hosts, and review who holds accounts on the instance.

Sources:NVDibm.comATLAS

What is the risk?

Medium overall. Exploitation needs only low privileges (any authenticated account) over the network, with low complexity and no user interaction, so it is easy to carry out once access exists. Confidentiality and integrity impact is low in the CVSS vector, with scope unchanged. Actual risk depends on exposure: instances with open self-registration, shared multi-user deployments, or cloud hosting with reachable metadata endpoints raise the impact. No exploitation in the wild, public exploit, or scanner template is known today (Confidence: MEDIUM, as EPSS and dependent counts are unavailable).

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker triggers a server-side request to an attacker-chosen internal URL through the vulnerable SSRF-prone functionality.

AML.T0049

Discovery

Attacker enumerates internal hosts, ports and services using the Langflow server as a proxy.

AML.T0006

Impact

Attacker reaches internal APIs or metadata services to gather credentials and data for further attacks.

Initial Access

Attacker obtains a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker triggers a server-side request to an attacker-chosen internal URL through the vulnerable SSRF-prone functionality.

AML.T0049

Discovery

Attacker enumerates internal hosts, ports and services using the Langflow server as a proxy.

AML.T0006

Impact

Attacker reaches internal APIs or metadata services to gather credentials and data for further attacks.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Until patched, limit accounts to trusted users, disable open self-registration, and avoid exposing the instance to the internet. 3) Apply egress filtering or a proxy allowlist on Langflow hosts, and block access to cloud metadata endpoints (enforce IMDSv2 or equivalent) and internal management networks. 4) Detect abuse by reviewing Langflow and network logs for outbound requests to internal IP ranges, link-local addresses (169.254.169.254) or unusual ports triggered by authenticated sessions. 5) Rotate credentials that were reachable from the Langflow host if suspicious activity is found.

How is it classified?

Data LeakageAuth BypassFrameworkAgentAML.T0006- Active Scanning AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104331?

Is CVE-2026-104331 actively exploited?

No confirmed active exploitation of CVE-2026-104331 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104331?

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Until patched, limit accounts to trusted users, disable open self-registration, and avoid exposing the instance to the internet. 3) Apply egress filtering or a proxy allowlist on Langflow hosts, and block access to cloud metadata endpoints (enforce IMDSv2 or equivalent) and internal management networks. 4) Detect abuse by reviewing Langflow and network logs for outbound requests to internal IP ranges, link-local addresses (169.254.169.254) or unusual ports triggered by authenticated sessions. 5) Rotate credentials that were reachable from the Langflow host if suspicious activity is found.

What systems are affected by CVE-2026-104331?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM orchestration platforms, RAG pipelines, Low-code AI workflow builders.

What is the CVSS score for CVE-2026-104331?

CVE-2026-104331 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM orchestration platformsRAG pipelinesLow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Exploitation Scenario

An attacker obtains a low-privilege account on a shared Langflow instance, for example through open registration or a stolen credential. They build or edit a flow, or call an endpoint, that makes the server fetch a URL they control, pointing it at internal addresses. By watching response differences and timing, they map internal hosts and ports, then reach the cloud metadata service or an internal vector database or model gateway to collect credentials and data, which they use to move deeper into the AI pipeline.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.