CVE-2026-10564: Langflow SSRF — HIGH

CISO Take

IBM Langflow's legacy RSS and SearXNG components make outbound HTTP requests to attacker-supplied URLs without honoring the SSRF protections that were added in version 1.9.3, letting an authenticated user — or an indirect prompt injection into an agentic flow that has tool_mode enabled — redirect the server to internal-only endpoints, including AWS/Azure/GCP instance metadata services, to harvest IAM credentials and map internal networks. This is CVSS 8.2/high, network-reachable, requires no elevated privileges and no user interaction beyond a standard account, though EPSS sits at just 0.2% and there is no CISA KEV listing, no public PoC, and no Nuclei template — meaning no evidence of active exploitation today. The real exposure isn't opportunistic internet scanning, it's that Langflow instances are frequently deployed with cloud IAM roles attached for agent tool use, so a successful SSRF here can escalate directly into cloud account compromise, and the prompt-injection trigger path means the attack surface extends to any external content an agent ingests, not just direct API callers. Patch to a release beyond 1.9.6 once IBM/Langflow ships one (track the linked advisory), and in the interim disable or firewall the RSSReaderComponent and SearXNG component, turn off tool_mode on both where not strictly required, and block egress from Langflow hosts to 169.254.169.254 and RFC1918 ranges. Detection teams should alert on any outbound request from a Langflow host to a metadata IP or internal network range as a high-fidelity indicator of exploitation attempts.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

High severity (CVSS 8.2) driven by confidentiality impact against cloud IAM credentials, but real-world exploitation likelihood is currently low: EPSS is 0.2%, there's no CISA KEV entry, no public exploit code, and no scanner/Nuclei template observed. Attack complexity is low and no special privileges or user interaction are needed once an attacker has any authenticated session, which keeps the bar low for anyone who already has access to a shared or multi-tenant Langflow deployment. The prompt-injection trigger path via tool_mode meaningfully raises risk for agentic deployments, since it removes the need for the attacker to hold Langflow credentials at all — untrusted content processed by an agent can be enough. Overall this should be treated as high-priority-but-not-emergency: patch on the normal high-severity cadence, but prioritize the egress-blocking workaround immediately for any instance with attached cloud IAM roles.

How does the attack unfold?

Entry point

Attacker with standard authenticated access configures the RSSReaderComponent/SearXNG component with an attacker-chosen URL, or plants an indirect prompt injection in content an agentic flow will later retrieve.

AML.T0051.001

Tool invocation

The flow executes (directly or via the agent's tool_mode invocation) and the vulnerable component makes an unvalidated server-side HTTP request to the attacker-specified internal target.

AML.T0053

Credential harvesting

The request reaches cloud instance metadata services (AWS/Azure/GCP IMDS) or internal network hosts, returning IAM role credentials or internal service data to the attacker via the component's output.

AML.T0106

Cloud pivot

The attacker uses the stolen IAM credentials to access other cloud resources reachable by the compromised role, escalating from an application-level SSRF to broader cloud account compromise.

AML.T0075

Entry point

Attacker with standard authenticated access configures the RSSReaderComponent/SearXNG component with an attacker-chosen URL, or plants an indirect prompt injection in content an agentic flow will later retrieve.

AML.T0051.001

Tool invocation

The flow executes (directly or via the agent's tool_mode invocation) and the vulnerable component makes an unvalidated server-side HTTP request to the attacker-specified internal target.

AML.T0053

Credential harvesting

The request reaches cloud instance metadata services (AWS/Azure/GCP IMDS) or internal network hosts, returning IAM role credentials or internal service data to the attacker via the component's output.

AML.T0106

Cloud pivot

The attacker uses the stolen IAM credentials to access other cloud resources reachable by the compromised role, escalating from an application-level SSRF to broader cloud account compromise.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.3K Pushed 2d ago 24% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

1) Upgrade Langflow past 1.9.6 as soon as IBM/Langflow publishes a fix that closes this specific bypass (monitor the linked IBM advisory for the patched version). 2) Until patched, disable or remove the RSSReaderComponent and SearXNG component from any flow, or restrict their use via feature flags/component allowlists if supported. 3) Turn off tool_mode=True for these components in any agentic workflow unless there is a validated business need, since that setting is what exposes them to indirect prompt-injection triggering. 4) Apply network-layer SSRF defenses independent of the application: block outbound access from Langflow hosts to 169.254.169.254 (and equivalent Azure/GCP metadata endpoints) and to RFC1918/internal ranges, using egress firewall rules, IMDSv2 enforcement, or a network proxy allowlist. 5) Scope IAM roles attached to Langflow hosts to least privilege so that even a successful metadata theft yields minimal blast radius. 6) Monitor logs/EDR/network telemetry for outbound requests from Langflow processes to metadata IPs or unexpected internal hosts as a detection signal.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt Injection Data Extraction Framework Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-10564?

IBM Langflow's legacy RSS and SearXNG components make outbound HTTP requests to attacker-supplied URLs without honoring the SSRF protections that were added in version 1.9.3, letting an authenticated user — or an indirect prompt injection into an agentic flow that has tool_mode enabled — redirect the server to internal-only endpoints, including AWS/Azure/GCP instance metadata services, to harvest IAM credentials and map internal networks. This is CVSS 8.2/high, network-reachable, requires no elevated privileges and no user interaction beyond a standard account, though EPSS sits at just 0.2% and there is no CISA KEV listing, no public PoC, and no Nuclei template — meaning no evidence of active exploitation today. The real exposure isn't opportunistic internet scanning, it's that Langflow instances are frequently deployed with cloud IAM roles attached for agent tool use, so a successful SSRF here can escalate directly into cloud account compromise, and the prompt-injection trigger path means the attack surface extends to any external content an agent ingests, not just direct API callers. Patch to a release beyond 1.9.6 once IBM/Langflow ships one (track the linked advisory), and in the interim disable or firewall the RSSReaderComponent and SearXNG component, turn off tool_mode on both where not strictly required, and block egress from Langflow hosts to 169.254.169.254 and RFC1918 ranges. Detection teams should alert on any outbound request from a Langflow host to a metadata IP or internal network range as a high-fidelity indicator of exploitation attempts.

Is CVE-2026-10564 actively exploited?

No confirmed active exploitation of CVE-2026-10564 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-10564?

1) Upgrade Langflow past 1.9.6 as soon as IBM/Langflow publishes a fix that closes this specific bypass (monitor the linked IBM advisory for the patched version). 2) Until patched, disable or remove the RSSReaderComponent and SearXNG component from any flow, or restrict their use via feature flags/component allowlists if supported. 3) Turn off tool_mode=True for these components in any agentic workflow unless there is a validated business need, since that setting is what exposes them to indirect prompt-injection triggering. 4) Apply network-layer SSRF defenses independent of the application: block outbound access from Langflow hosts to 169.254.169.254 (and equivalent Azure/GCP metadata endpoints) and to RFC1918/internal ranges, using egress firewall rules, IMDSv2 enforcement, or a network proxy allowlist. 5) Scope IAM roles attached to Langflow hosts to least privilege so that even a successful metadata theft yields minimal blast radius. 6) Monitor logs/EDR/network telemetry for outbound requests from Langflow processes to metadata IPs or unexpected internal hosts as a detection signal.

What systems are affected by CVE-2026-10564?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI workflow builders, RAG pipelines.

What is the CVSS score for CVE-2026-10564?

CVE-2026-10564 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI workflow buildersRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), potentially exfiltrating IAM credentials and enumerating internal networks. The vulnerability can also be triggered through prompt injection in agentic workflows due to tool_mode=True exposure.

Exploitation Scenario

An attacker with a standard authenticated account on a shared Langflow instance builds or edits a flow that wires the RSSReaderComponent to fetch 'http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>' instead of a legitimate feed URL, and the component's unvalidated HTTP client dutifully retrieves and displays the response inside Langflow, handing the attacker temporary AWS IAM credentials for the host's attached role. Alternatively, in an agentic deployment where a research or content-summarization agent has the SearXNG component wired with tool_mode=True, an attacker plants an indirect prompt injection inside a web page or RSS item the agent is likely to retrieve during normal operation; when the agent processes that content, the injected instructions coerce it into invoking the SearXNG tool against an internal URL or the cloud metadata endpoint, exfiltrating the response back through the agent's own output channel — all without the attacker ever directly authenticating to Langflow. From there the attacker uses the harvested IAM credentials to enumerate and access other cloud resources the role can reach, turning an SSRF in a low-code AI tool into a cloud account compromise.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.