CVE-2026-7754: Langflow SSRF — MEDIUM

CISO Take

IBM disclosed that Langflow (a widely used low-code framework for building LLM and agent pipelines) ships with an insecure default configuration whose SSRF protection can be bypassed, letting a low-privileged, unauthenticated-in-effect user coerce the server into making requests to internal or cloud-only endpoints. This matters because Langflow instances are typically deployed with outbound network access to internal services, databases, and cloud metadata endpoints (AWS/GCP/Azure IMDS) to power agent tool calls and integrations — an SSRF here can be a direct path to cloud credential theft or internal network reconnaissance, not just a data-confidentiality footnote. There is no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, but the vulnerability requires only low privileges, no user interaction, and low attack complexity (CVSS 7.7, AV:N/AC:L/PR:L), which is a favorable profile for rapid weaponization once details spread. Patch to a fixed Langflow release as soon as IBM/Langflow publish one, and in the meantime restrict outbound network egress from Langflow hosts (deny-list cloud metadata IPs like 169.254.169.254, enforce network segmentation) and audit for anomalous outbound requests in Langflow logs.

Sources: NVD ibm.com

What is the risk?

High severity (CVSS 7.7) with a favorable exploitability profile: network-reachable, low attack complexity, no user interaction, and only low privileges required. The confidentiality impact is high while integrity and availability are unaffected, consistent with classic SSRF used for internal reconnaissance or credential harvesting rather than direct system takeover. No public PoC, Nuclei template, or KEV listing currently exists, and EPSS data is unavailable, so near-term mass exploitation is unconfirmed — but the low bar for exploitation combined with Langflow's popularity as an agent-building framework makes this a candidate for rapid escalation once a working bypass is published.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged access to a Langflow instance, such as a standard user account or API token.

AML.T0049

SSRF Bypass

Attacker crafts a flow component (e.g., HTTP request node) targeting an internal or cloud-metadata URL that evades Langflow's incomplete SSRF filter.

Internal Reconnaissance / Credential Access

The Langflow backend executes the request server-side, reaching internal services or cloud instance metadata and returning sensitive data or credentials to the attacker.

AML.T0075

Impact

Attacker leverages harvested credentials or internal data for lateral movement, further exfiltration, or compromise of the broader AI pipeline environment.

AML.T0055

Initial Access

Attacker obtains low-privileged access to a Langflow instance, such as a standard user account or API token.

AML.T0049

SSRF Bypass

Attacker crafts a flow component (e.g., HTTP request node) targeting an internal or cloud-metadata URL that evades Langflow's incomplete SSRF filter.

Internal Reconnaissance / Credential Access

The Langflow backend executes the request server-side, reaching internal services or cloud instance metadata and returning sensitive data or credentials to the attacker.

AML.T0075

Impact

Attacker leverages harvested credentials or internal data for lateral movement, further exfiltration, or compromise of the broader AI pipeline environment.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade Langflow to the version IBM/Langflow ships that fully enforces the SSRF protection mechanism as soon as it is available; track the vendor advisory at the referenced IBM support page for the fix version. Until patched, do not rely solely on Langflow's built-in SSRF filter — enforce network-level controls: block egress to cloud metadata IPs (169.254.169.254, metadata.google.internal), place Langflow behind an egress proxy/allowlist, and run it in a network segment without direct access to sensitive internal services. Detection: monitor Langflow application and network logs for outbound requests to internal IP ranges, link-local addresses, or metadata endpoints, and alert on requests originating from flow/component execution rather than the admin UI. Apply least-privilege IAM roles to the compute instance hosting Langflow so that even a successful metadata-endpoint SSRF yields minimal credential value.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Data Leakage Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.3 - Third-party risks are identified and managed

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-7754?

IBM disclosed that Langflow (a widely used low-code framework for building LLM and agent pipelines) ships with an insecure default configuration whose SSRF protection can be bypassed, letting a low-privileged, unauthenticated-in-effect user coerce the server into making requests to internal or cloud-only endpoints. This matters because Langflow instances are typically deployed with outbound network access to internal services, databases, and cloud metadata endpoints (AWS/GCP/Azure IMDS) to power agent tool calls and integrations — an SSRF here can be a direct path to cloud credential theft or internal network reconnaissance, not just a data-confidentiality footnote. There is no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, but the vulnerability requires only low privileges, no user interaction, and low attack complexity (CVSS 7.7, AV:N/AC:L/PR:L), which is a favorable profile for rapid weaponization once details spread. Patch to a fixed Langflow release as soon as IBM/Langflow publish one, and in the meantime restrict outbound network egress from Langflow hosts (deny-list cloud metadata IPs like 169.254.169.254, enforce network segmentation) and audit for anomalous outbound requests in Langflow logs.

Is CVE-2026-7754 actively exploited?

No confirmed active exploitation of CVE-2026-7754 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7754?

Upgrade Langflow to the version IBM/Langflow ships that fully enforces the SSRF protection mechanism as soon as it is available; track the vendor advisory at the referenced IBM support page for the fix version. Until patched, do not rely solely on Langflow's built-in SSRF filter — enforce network-level controls: block egress to cloud metadata IPs (169.254.169.254, metadata.google.internal), place Langflow behind an egress proxy/allowlist, and run it in a network segment without direct access to sensitive internal services. Detection: monitor Langflow application and network logs for outbound requests to internal IP ranges, link-local addresses, or metadata endpoints, and alert on requests originating from flow/component execution rather than the admin UI. Apply least-privilege IAM roles to the compute instance hosting Langflow so that even a successful metadata-endpoint SSRF yields minimal credential value.

What systems are affected by CVE-2026-7754?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving, low-code AI orchestration.

What is the CVSS score for CVE-2026-7754?

CVE-2026-7754 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel servinglow-code AI orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.

Exploitation Scenario

An attacker with low-privileged access to a Langflow instance (e.g., a standard user account or an API token with component-creation rights) configures a flow component — such as an HTTP request node or a URL-fetching tool — pointing at an internal or cloud-metadata URL, exploiting the incomplete SSRF filter to bypass allow/deny-list checks. Langflow's backend, which typically runs with network access to internal services and possibly a cloud IAM role, executes the request on the attacker's behalf and returns the response (e.g., cloud credentials from the instance metadata service, or contents of an internal admin API) back through the flow's output, which the attacker can then read via the UI or API. The attacker uses those harvested credentials or internal data for lateral movement, further reconnaissance, or exfiltration of data feeding the AI pipeline.