AI Threat AlertCVE-2026-12766: Langflow: SSRF allows internal network probing
MEDIUMIBM Langflow OSS 1.0.0 through 1.11.2 contains a server-side request forgery (SSRF) flaw that lets an authenticated low-privilege user make the server send requests to arbitrary destinations, enabling internal network enumeration and acting as a stepping stone for other attacks. Overall risk is moderate: CVSS is 5.4, there is no public exploit, no Nuclei template, and it is not in CISA KEV, and CISA SSVC rates it TRACK. However, the EPSS score of 0.00181 sits in the top 93rd percentile, so it is still more likely to be probed than most CVEs, and Langflow servers often hold LLM API keys and sit inside trusted networks where cloud metadata endpoints are reachable. Upgrade to a fixed Langflow release per the IBM advisory (https://www.ibm.com/support/pages/node/7285639), restrict Langflow's egress to approved destinations, and enforce IMDSv2 on cloud hosts.
What is the risk?
Medium. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) shows a network-reachable, low-complexity flaw that needs only a low-privileged account, with limited confidentiality and integrity impact. No known exploitation (not in KEV, no public PoC, no scanner template), and SSVC is TRACK. The EPSS percentile (top 93%) suggests above-average exploitation interest. Real-world risk rises sharply where Langflow runs with open self-registration, shared multi-tenant access, or in cloud/VPC environments where metadata services and internal APIs are reachable. Exact exposure depends on the SSRF response behavior (blind vs. full-read), which the advisory does not specify.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Langflow to the fixed version identified in the IBM advisory (https://www.ibm.com/support/pages/node/7285639); versions 1.0.0 through 1.11.2 are affected. 2) Apply egress filtering so the Langflow host/container can only reach approved external endpoints, and block access to link-local (169.254.169.254), loopback, and RFC1918 ranges not required by flows. 3) Enforce IMDSv2 (or disable metadata access) on cloud instances and use least-privilege IAM roles for the Langflow workload. 4) Restrict who can register or log in to Langflow; disable open signup and avoid exposing the UI to the internet. 5) Detection: monitor Langflow and proxy logs for outbound requests to internal IP ranges, metadata endpoints, or unusual ports and hosts, and alert on bursts of requests from a single user session consistent with scanning.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-12766?
IBM Langflow OSS 1.0.0 through 1.11.2 contains a server-side request forgery (SSRF) flaw that lets an authenticated low-privilege user make the server send requests to arbitrary destinations, enabling internal network enumeration and acting as a stepping stone for other attacks. Overall risk is moderate: CVSS is 5.4, there is no public exploit, no Nuclei template, and it is not in CISA KEV, and CISA SSVC rates it TRACK. However, the EPSS score of 0.00181 sits in the top 93rd percentile, so it is still more likely to be probed than most CVEs, and Langflow servers often hold LLM API keys and sit inside trusted networks where cloud metadata endpoints are reachable. Upgrade to a fixed Langflow release per the IBM advisory (https://www.ibm.com/support/pages/node/7285639), restrict Langflow's egress to approved destinations, and enforce IMDSv2 on cloud hosts.
Is CVE-2026-12766 actively exploited?
No confirmed active exploitation of CVE-2026-12766 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-12766?
1) Upgrade Langflow to the fixed version identified in the IBM advisory (https://www.ibm.com/support/pages/node/7285639); versions 1.0.0 through 1.11.2 are affected. 2) Apply egress filtering so the Langflow host/container can only reach approved external endpoints, and block access to link-local (169.254.169.254), loopback, and RFC1918 ranges not required by flows. 3) Enforce IMDSv2 (or disable metadata access) on cloud instances and use least-privilege IAM roles for the Langflow workload. 4) Restrict who can register or log in to Langflow; disable open signup and avoid exposing the UI to the internet. 5) Detection: monitor Langflow and proxy logs for outbound requests to internal IP ranges, metadata endpoints, or unusual ports and hosts, and alert on bursts of requests from a single user session consistent with scanning.
What systems are affected by CVE-2026-12766?
This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Self-hosted AI development platforms.
What is the CVSS score for CVE-2026-12766?
CVE-2026-12766 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.25%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0006Active ScanningAML.T0049Exploit Public-Facing ApplicationAML.T0075Cloud Service DiscoveryCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Exploitation Scenario
An attacker obtains a low-privilege Langflow account through open registration, a phished user, or reused credentials. They use the vulnerable URL-fetching functionality to submit requests pointing at internal addresses, enumerating live hosts and open ports behind the firewall. They then target the cloud metadata endpoint or an unauthenticated internal service (such as a vector database or model-serving API) to read configuration or credentials, and use these to reach LLM provider keys, training data, or other AI infrastructure.
Weaknesses (CWE)
CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- [Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
- [Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow