CVE-2026-12765: Langflow: unauthenticated SSRF enables internal network probing

MEDIUM

Published September 14, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.10.2 contains a server-side request forgery flaw (CWE-918) that lets an unauthenticated remote attacker make the Langflow server send requests on their behalf, which can be used to map internal networks or reach services that are not exposed externally. Exploitation is low-complexity and needs no credentials or user interaction, but the impact is limited to low confidentiality and integrity (CVSS 6.5), and there is no public exploit, no Nuclei template, and no CISA KEV listing. EPSS is low (0.00216) though it sits in the 89th percentile, and CISA SSVC rates it TRACK, so this is a scheduled-patching item rather than an emergency. The practical risk is higher for internet-exposed Langflow instances or those running in cloud environments, where SSRF can reach metadata endpoints and internal APIs. Upgrade to the fixed version listed in IBM's advisory (node 7285644), and restrict Langflow's network exposure and egress in the meantime.

Sources:NVDEPSSATLASibm.comCISA SSVC

What is the risk?

Medium overall. Exploitability is high in principle (network vector, low complexity, no privileges, no user interaction), but there is no known public exploit, no KEV listing, and EPSS is low in absolute terms (0.22%). Impact is limited to low confidentiality and integrity with no availability effect. Risk rises sharply for internet-facing instances and for deployments in cloud environments where SSRF could reach instance metadata services or internal management APIs, enabling credential theft or lateral movement. Note: the structured data lists no affected products and the package risk score is 0/100, so confidence in scope relies on the vendor advisory and description (confidence: MEDIUM).

How does the attack unfold?

Reconnaissance

Attacker identifies internet-exposed Langflow instances running versions 1.0.0 through 1.10.2.

AML.T0006

Initial Access

Attacker sends an unauthenticated request containing an attacker-controlled URL to a vulnerable Langflow endpoint.

AML.T0049

Internal Discovery

The Langflow server issues requests to internal hosts or metadata endpoints, revealing live services and open ports.

Impact

Attacker uses gathered internal data to enumerate the network and stage follow-on attacks against connected AI infrastructure.

Reconnaissance

Attacker identifies internet-exposed Langflow instances running versions 1.0.0 through 1.10.2.

AML.T0006

Initial Access

Attacker sends an unauthenticated request containing an attacker-controlled URL to a vulnerable Langflow endpoint.

AML.T0049

Internal Discovery

The Langflow server issues requests to internal hosts or metadata endpoints, revealing live services and open ports.

Impact

Attacker uses gathered internal data to enumerate the network and stage follow-on attacks against connected AI infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 4d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed release identified in IBM's advisory (https://www.ibm.com/support/pages/node/7285644); versions 1.0.0 through 1.10.2 are affected. 2) Do not expose Langflow directly to the internet; place it behind an authenticating reverse proxy, VPN or zero-trust gateway. 3) Apply egress filtering so the Langflow host can only reach required destinations; block access to 169.254.169.254 and other link-local or RFC1918 ranges not needed. 4) Enforce IMDSv2 (or the equivalent) on cloud hosts to blunt metadata theft. 5) Detection: review web and proxy logs for unauthenticated requests to Langflow endpoints containing URL parameters pointing to internal IPs, localhost or metadata addresses, and alert on unusual outbound connections from the Langflow host to internal subnets. 6) Rotate credentials stored in Langflow if suspicious internal requests are found.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAPIAML.T0006- Active Scanning AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-12765?

Is CVE-2026-12765 actively exploited?

No confirmed active exploitation of CVE-2026-12765 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12765?

1) Upgrade Langflow OSS to the fixed release identified in IBM's advisory (https://www.ibm.com/support/pages/node/7285644); versions 1.0.0 through 1.10.2 are affected. 2) Do not expose Langflow directly to the internet; place it behind an authenticating reverse proxy, VPN or zero-trust gateway. 3) Apply egress filtering so the Langflow host can only reach required destinations; block access to 169.254.169.254 and other link-local or RFC1918 ranges not needed. 4) Enforce IMDSv2 (or the equivalent) on cloud hosts to blunt metadata theft. 5) Detection: review web and proxy logs for unauthenticated requests to Langflow endpoints containing URL parameters pointing to internal IPs, localhost or metadata addresses, and alert on unusual outbound connections from the Langflow host to internal subnets. 6) Rotate credentials stored in Langflow if suspicious internal requests are found.

What systems are affected by CVE-2026-12765?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, Agent frameworks, RAG pipelines, Visual low-code AI builders.

What is the CVSS score for CVE-2026-12765?

CVE-2026-12765 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestrationAgent frameworksRAG pipelinesVisual low-code AI builders

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances and identifies a version between 1.0.0 and 1.10.2. Without authenticating, they submit a crafted request to a Langflow endpoint that fetches a user-supplied URL, pointing it at internal addresses. By observing response differences and timing, they enumerate internal hosts and open ports, including the vector database, model gateway and, in cloud deployments, the instance metadata service. The information gathered is then used to target weaker internal services or to harvest credentials for follow-on attacks against the AI pipeline.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.