CVE-2026-12767: Langflow: unauthenticated SSRF enables internal probing

MEDIUM

Published September 14, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a server-side request forgery (CWE-918) flaw that lets an unauthenticated remote attacker make the server send requests to destinations of their choosing, enabling internal network enumeration and follow-on attacks. Severity is medium (CVSS 6.5), and exploitation is low-risk to attempt because it needs no privileges or user interaction. Real-world exploitation signals are modest: the CVE is not in CISA KEV, no public exploit or Nuclei template exists, CISA SSVC says TRACK, and EPSS is low at 0.2%, although that score sits in the top 89th percentile. Langflow has a history of being targeted by attackers, and instances often run in cloud environments where SSRF can reach metadata services and internal APIs, so internet-exposed deployments deserve priority. Upgrade to a fixed release per the IBM advisory (node 7286665), and until then restrict public access to Langflow and apply egress filtering.

Sources:NVDEPSSCISA SSVCATLASibm.com

What is the risk?

Medium overall. Exploitability is high in principle (network vector, low complexity, no privileges, no user interaction), but there is no public exploit, no KEV listing and a low EPSS of 0.00216 (top 89th percentile), so the near-term likelihood of mass exploitation is limited. Impact is bounded to low confidentiality and low integrity (C:L/I:L, no availability impact), but SSRF severity depends heavily on deployment context: a Langflow host in a cloud VPC with access to instance metadata or internal services can turn a medium CVSS into a credential-theft or lateral-movement path. Risk is highest for internet-facing instances without authentication in front of them.

How does the attack unfold?

Reconnaissance

Attacker identifies an exposed Langflow instance running a version between 1.0.0 and 1.11.5.

AML.T0006

Initial Access / Exploitation

Attacker sends an unauthenticated request with an attacker-chosen URL, forcing the server to issue the outbound request.

AML.T0049

Discovery

Server responses expose internal hosts, ports and possibly cloud metadata, mapping the internal network.

AML.T0075

Impact

Harvested internal data or credentials enable lateral movement toward vector stores, model endpoints or other internal services.

Reconnaissance

Attacker identifies an exposed Langflow instance running a version between 1.0.0 and 1.11.5.

AML.T0006

Initial Access / Exploitation

Attacker sends an unauthenticated request with an attacker-chosen URL, forcing the server to issue the outbound request.

AML.T0049

Discovery

Server responses expose internal hosts, ports and possibly cloud metadata, mapping the internal network.

AML.T0075

Impact

Harvested internal data or credentials enable lateral movement toward vector stores, model endpoints or other internal services.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 4d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Langflow to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7286665); versions above 1.11.5 are expected to contain the fix, so verify against the advisory. 2) Do not expose Langflow directly to the internet; place it behind an authenticating reverse proxy, VPN or zero-trust gateway. 3) Apply egress filtering on the Langflow host or container to block access to link-local (169.254.169.254), loopback and private RFC1918 ranges not required by flows. 4) Enforce IMDSv2 or equivalent metadata protections on cloud instances. 5) Detection: review web and proxy logs for requests to Langflow containing internal IPs, localhost or metadata URLs, and alert on unusual outbound connections from the Langflow host to internal subnets. 6) Rotate LLM provider keys and stored credentials if suspicious activity is found.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAPIAML.T0006- Active Scanning AML.T0049- Exploit Public-Facing Application AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-12767?

Is CVE-2026-12767 actively exploited?

No confirmed active exploitation of CVE-2026-12767 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12767?

1) Upgrade Langflow to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7286665); versions above 1.11.5 are expected to contain the fix, so verify against the advisory. 2) Do not expose Langflow directly to the internet; place it behind an authenticating reverse proxy, VPN or zero-trust gateway. 3) Apply egress filtering on the Langflow host or container to block access to link-local (169.254.169.254), loopback and private RFC1918 ranges not required by flows. 4) Enforce IMDSv2 or equivalent metadata protections on cloud instances. 5) Detection: review web and proxy logs for requests to Langflow containing internal IPs, localhost or metadata URLs, and alert on unusual outbound connections from the Langflow host to internal subnets. 6) Rotate LLM provider keys and stored credentials if suspicious activity is found.

What systems are affected by CVE-2026-12767?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, Agent frameworks, RAG pipelines, Low-code AI application builders.

What is the CVSS score for CVE-2026-12767?

CVE-2026-12767 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestrationAgent frameworksRAG pipelinesLow-code AI application builders

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0049Exploit Public-Facing Application

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances and identifies a version between 1.0.0 and 1.11.5. Without authenticating, they send a crafted request to the vulnerable function with a URL pointing at an internal address, such as the cloud metadata service or an internal vector database. The Langflow server fetches the resource on their behalf, letting the attacker enumerate internal hosts and ports by observing response differences and potentially retrieve limited data, such as cloud role credentials. They then use harvested credentials or discovered internal services to move laterally into the AI/ML environment.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.