CVE-2026-81213: Langflow SSRF exposes internal

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.5 fail to properly validate user-supplied URLs, allowing a remote, unauthenticated attacker to force the server to make requests into internal network segments and return the response — a classic server-side request forgery (SSRF) with a CVSS 3.1 score of 8.6 and a changed scope, meaning the blast radius extends beyond the Langflow process itself. There is no evidence of a public exploit, no Nuclei template, and it is not in CISA KEV, but the attack requires no authentication or user interaction and has low complexity, so any organization exposing a Langflow instance to an untrusted network is at immediate risk of internal reconnaissance, cloud metadata theft (IAM credentials, instance tokens), or lateral pivoting into services that were never meant to be internet-facing. Langflow has a documented history of actively exploited vulnerabilities (its prior RCE was added to CISA KEV), so treat any unauthenticated network-reachable weakness in this framework with elevated urgency even absent current exploitation telemetry. Patch to a version beyond 1.11.5 as soon as IBM/Langflow publishes the fix, and in the meantime restrict Langflow's egress and inbound exposure with network segmentation, disable or tightly allowlist any component that accepts user-supplied URLs, and monitor for outbound requests from the Langflow host to internal-only IP ranges (169.254.169.254, RFC1918) or unexpected destinations.

Sources: NVD ATLAS IBM support advisory (ibm.com)

What is the risk?

High risk for any internet- or intranet-exposed Langflow deployment: AV:N/AC:L/PR:N/UI:N means zero-friction remote exploitation, and S:C (scope changed) with C:H reflects that the vulnerability lets an attacker read data outside Langflow's own security boundary — typically the internal network, cloud metadata service, or other backend systems reachable only from the Langflow host. No public PoC, Nuclei template, or EPSS/KEV signal currently exists, which lowers near-term mass-exploitation likelihood but does not reduce severity for targeted attackers scanning for exposed Langflow instances (a common pattern given Langflow's popularity as a low-code agent/RAG builder and its prior KEV-listed RCE).

How does the attack unfold?

Initial Access

Attacker locates an unauthenticated, network-reachable Langflow instance and identifies a flow component accepting a user-supplied URL.

AML.T0049

SSRF Exploitation

Attacker submits a malicious URL pointing to an internal-only address, causing Langflow's backend to fetch it on their behalf.

AML.T0075

Impact

The internal response (cloud metadata, credentials, internal service data) is returned to the attacker through Langflow's UI or API, leaking sensitive information.

Initial Access

Attacker locates an unauthenticated, network-reachable Langflow instance and identifies a flow component accepting a user-supplied URL.

AML.T0049

SSRF Exploitation

Attacker submits a malicious URL pointing to an internal-only address, causing Langflow's backend to fetch it on their behalf.

AML.T0075

Impact

The internal response (cloud metadata, credentials, internal service data) is returned to the attacker through Langflow's UI or API, leaking sensitive information.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I None

A None

What should I do?

1 step

1) Upgrade Langflow to the patched release above 1.11.5 as soon as it is available (check IBM's advisory at the referenced support page for the fix version). 2) If patching is delayed, disable IMDSv1 and enforce IMDSv2 with hop-limit 1 on any cloud instance hosting Langflow to blunt metadata-endpoint SSRF. 3) Place Langflow behind a network policy that denies egress to RFC1918 ranges and 169.254.169.254 except where explicitly required. 4) Restrict or disable Langflow components/nodes that accept arbitrary user-supplied URLs (URL loader, HTTP request node) until patched, or front them with an allowlist proxy. 5) Detection: alert on outbound connections from the Langflow host to internal-only IPs or metadata IPs that don't match expected flow configurations; review Langflow flow definitions for unexpected external URL parameters. 6) Ensure Langflow is not directly internet-exposed without authentication/reverse-proxy access controls.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Data Extraction Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security is evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-81213?

IBM Langflow OSS versions 1.0.0 through 1.11.5 fail to properly validate user-supplied URLs, allowing a remote, unauthenticated attacker to force the server to make requests into internal network segments and return the response — a classic server-side request forgery (SSRF) with a CVSS 3.1 score of 8.6 and a changed scope, meaning the blast radius extends beyond the Langflow process itself. There is no evidence of a public exploit, no Nuclei template, and it is not in CISA KEV, but the attack requires no authentication or user interaction and has low complexity, so any organization exposing a Langflow instance to an untrusted network is at immediate risk of internal reconnaissance, cloud metadata theft (IAM credentials, instance tokens), or lateral pivoting into services that were never meant to be internet-facing. Langflow has a documented history of actively exploited vulnerabilities (its prior RCE was added to CISA KEV), so treat any unauthenticated network-reachable weakness in this framework with elevated urgency even absent current exploitation telemetry. Patch to a version beyond 1.11.5 as soon as IBM/Langflow publishes the fix, and in the meantime restrict Langflow's egress and inbound exposure with network segmentation, disable or tightly allowlist any component that accepts user-supplied URLs, and monitor for outbound requests from the Langflow host to internal-only IP ranges (169.254.169.254, RFC1918) or unexpected destinations.

Is CVE-2026-81213 actively exploited?

No confirmed active exploitation of CVE-2026-81213 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-81213?

1) Upgrade Langflow to the patched release above 1.11.5 as soon as it is available (check IBM's advisory at the referenced support page for the fix version). 2) If patching is delayed, disable IMDSv1 and enforce IMDSv2 with hop-limit 1 on any cloud instance hosting Langflow to blunt metadata-endpoint SSRF. 3) Place Langflow behind a network policy that denies egress to RFC1918 ranges and 169.254.169.254 except where explicitly required. 4) Restrict or disable Langflow components/nodes that accept arbitrary user-supplied URLs (URL loader, HTTP request node) until patched, or front them with an allowlist proxy. 5) Detection: alert on outbound connections from the Langflow host to internal-only IPs or metadata IPs that don't match expected flow configurations; review Langflow flow definitions for unexpected external URL parameters. 6) Ensure Langflow is not directly internet-exposed without authentication/reverse-proxy access controls.

What systems are affected by CVE-2026-81213?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, low-code AI workflow builders.

What is the CVSS score for CVE-2026-81213?

CVE-2026-81213 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelineslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.

Exploitation Scenario

An attacker discovers a Langflow instance exposed on a corporate network or the internet (common in AI/ML dev environments) and identifies a flow or component that accepts a URL parameter — for example, a data-loader node meant to fetch a document from a public link. Without authentication, the attacker submits a request pointing that URL parameter to an internal address such as the cloud metadata service or an internal admin API. Langflow's backend, running inside the trusted network/cloud VPC, dutifully fetches the attacker-chosen URL and returns the response content back through the Langflow UI or API, handing the attacker cloud IAM credentials, internal service banners, or other sensitive internal data that would otherwise be unreachable from outside.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.