CVE-2026-79723: Langflow SSRF — MEDIUM

CISO Take

IBM Langflow, the visual builder widely used to assemble LLM and agent workflows, fails to properly validate user-supplied API endpoint parameters, letting a low-privileged authenticated user trigger server-side request forgery (CWE-918) and pull back sensitive information the application shouldn't expose. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't an imminent mass-exploitation risk — but Langflow instances are frequently deployed with broad network access to internal APIs, credential stores, and cloud metadata services, which is exactly what SSRF is used to reach. The requirement for authentication (PR:L) and the confidentiality-only impact (C:L/I:N/A:N) keep the CVSS at 5.0/medium, but any org running Langflow with multi-tenant or lower-trust users should treat this as a real internal-pivot risk, not noise. Upgrade to a patched Langflow release above 1.11.5 as soon as IBM publishes one (track the advisory at ibm.com/support/pages/node/7286665), and in the meantime restrict which users can reach the affected API endpoints and egress-filter the Langflow host so it cannot reach internal-only services or cloud metadata IPs (e.g., 169.254.169.254). Detection teams should watch Langflow's outbound request logs for connections to unexpected internal hosts or metadata endpoints originating from workflow/API-endpoint configuration actions.

Sources: NVD ATLAS ibm.com

What is the risk?

Medium severity (CVSS 5.0) driven by a network-exploitable, low-complexity SSRF that requires only low-privilege authentication and no user interaction. The blast radius is currently bounded by the need for an authenticated account and the confidentiality-only impact (no integrity or availability loss), and there is no evidence of active exploitation, KEV listing, public exploit code, or scanner coverage. However, SSRF vulnerabilities in AI orchestration tools are historically high-value because these platforms are often granted broad outbound network access to connect to model APIs, vector databases, and internal services — turning a modest CVSS score into a meaningful lateral-movement or credential-exposure risk in practice.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privileged authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker sets a malicious, internally-routable URL in a user-controlled API endpoint field, exploiting improper validation (CWE-918 SSRF).

AML.T0049

Discovery

The server-side request is used to probe internal services or cloud metadata endpoints reachable from the Langflow host.

AML.T0075

Impact

Sensitive information returned by the internal target (configuration, credentials, or service data) is disclosed back to the attacker via Langflow.

AML.T0024

Initial Access

Attacker obtains or already holds a low-privileged authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker sets a malicious, internally-routable URL in a user-controlled API endpoint field, exploiting improper validation (CWE-918 SSRF).

AML.T0049

Discovery

The server-side request is used to probe internal services or cloud metadata endpoints reachable from the Langflow host.

AML.T0075

Impact

Sensitive information returned by the internal target (configuration, credentials, or service data) is disclosed back to the attacker via Langflow.

AML.T0024

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I None

A None

What should I do?

1 step

1) Patch: upgrade Langflow beyond 1.11.5 as soon as IBM releases a fixed version — monitor the referenced advisory (ibm.com/support/pages/node/7286665) for the exact version. 2) Workaround: restrict which authenticated roles can create or modify API-endpoint-referencing components/workflows; apply least privilege to non-admin Langflow accounts. 3) Network hardening: deploy Langflow behind an egress proxy/allowlist so the application host cannot reach internal-only services, management APIs, or cloud metadata endpoints (169.254.169.254 for AWS/GCP/Azure). 4) Detection: monitor Langflow's outbound HTTP logs for requests to unexpected internal IP ranges or metadata service endpoints correlated with workflow/component save or execute events; alert on requests from non-admin accounts targeting internal hostnames. 5) Reduce blast radius by isolating Langflow's service account/credentials from sensitive internal systems.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Data Extraction Framework API AML.T0049 - Exploit Public-Facing Application AML.T0075 - Cloud Service Discovery AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system security controls in operation

NIST AI RMF

MANAGE-2.3 - Mechanisms for third-party and supply chain risk monitoring

OWASP LLM Top 10

LLM07 - Insecure Plugin/Component Design

Frequently Asked Questions

What is CVE-2026-79723?

IBM Langflow, the visual builder widely used to assemble LLM and agent workflows, fails to properly validate user-supplied API endpoint parameters, letting a low-privileged authenticated user trigger server-side request forgery (CWE-918) and pull back sensitive information the application shouldn't expose. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't an imminent mass-exploitation risk — but Langflow instances are frequently deployed with broad network access to internal APIs, credential stores, and cloud metadata services, which is exactly what SSRF is used to reach. The requirement for authentication (PR:L) and the confidentiality-only impact (C:L/I:N/A:N) keep the CVSS at 5.0/medium, but any org running Langflow with multi-tenant or lower-trust users should treat this as a real internal-pivot risk, not noise. Upgrade to a patched Langflow release above 1.11.5 as soon as IBM publishes one (track the advisory at ibm.com/support/pages/node/7286665), and in the meantime restrict which users can reach the affected API endpoints and egress-filter the Langflow host so it cannot reach internal-only services or cloud metadata IPs (e.g., 169.254.169.254). Detection teams should watch Langflow's outbound request logs for connections to unexpected internal hosts or metadata endpoints originating from workflow/API-endpoint configuration actions.

Is CVE-2026-79723 actively exploited?

No confirmed active exploitation of CVE-2026-79723 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-79723?

1) Patch: upgrade Langflow beyond 1.11.5 as soon as IBM releases a fixed version — monitor the referenced advisory (ibm.com/support/pages/node/7286665) for the exact version. 2) Workaround: restrict which authenticated roles can create or modify API-endpoint-referencing components/workflows; apply least privilege to non-admin Langflow accounts. 3) Network hardening: deploy Langflow behind an egress proxy/allowlist so the application host cannot reach internal-only services, management APIs, or cloud metadata endpoints (169.254.169.254 for AWS/GCP/Azure). 4) Detection: monitor Langflow's outbound HTTP logs for requests to unexpected internal IP ranges or metadata service endpoints correlated with workflow/component save or execute events; alert on requests from non-admin accounts targeting internal hostnames. 5) Reduce blast radius by isolating Langflow's service account/credentials from sensitive internal systems.

What systems are affected by CVE-2026-79723?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, API integrations.

What is the CVSS score for CVE-2026-79723?

CVE-2026-79723 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesAPI integrations

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0075 Cloud Service Discovery

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.

Exploitation Scenario

An attacker obtains or is granted a low-privileged authenticated account on a shared Langflow instance (e.g., an internal AI-tooling platform available to a wide developer population). Using the workflow builder, the attacker configures a component's API endpoint field with a URL pointing at an internal-only service or the cloud provider's instance metadata endpoint instead of the intended external API. Because Langflow does not properly validate the destination, it issues the request server-side on the attacker's behalf (CWE-918 SSRF), returning the response — potentially including internal service data, configuration details, or cloud credentials — back to the attacker through the Langflow UI or API response.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.