CVE-2025-68477: Langflow API Request Component SSRF Vulnerability

CVE-2025-68477 Overview

CVE-2025-68477 is a Server-Side Request Forgery (SSRF) vulnerability in Langflow, a platform for building and deploying AI-powered agents and workflows. The flaw exists in the API Request component in versions prior to 1.7.0. The component accepts a user-supplied URL, applies only basic normalization checks, and issues the request through a server-side httpx client. It fails to block private IP ranges or cloud metadata endpoints, and it returns the response body to the caller. An authenticated attacker with an API key can invoke flow execution endpoints to reach internal services from the Langflow server's network context.

Critical Impact
Authenticated attackers can access internal administrative endpoints, cloud metadata services, and internal databases, leading to information disclosure and lateral movement.

Affected Products

Langflow versions prior to 1.7.0
Deployments exposing /api/v1/run or /api/v1/run/advanced endpoints
Flows that include the API Request component with attacker-controllable URLs

Discovery Timeline

2025-12-19 - CVE-2025-68477 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2025-68477

Vulnerability Analysis

The vulnerability is classified as [CWE-918] Server-Side Request Forgery. Langflow's API Request component is designed to make arbitrary HTTP requests as part of a workflow. The component performs URL normalization and format validation but omits allow-list or deny-list enforcement for destination hosts.

Because the request executes server-side, the Langflow process reaches destinations that external clients cannot. The response body is returned to the flow caller, producing a non-blind SSRF primitive. Attackers can enumerate internal services and exfiltrate their responses in a single request-response cycle.

Root Cause

The root cause is missing network-level input validation on the destination URL. The component does not reject requests targeting loopback addresses such as 127.0.0.1, RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or the cloud metadata address 169.254.169.254. Format checks alone do not constrain the network scope of outbound requests.

Attack Vector

Exploitation requires a valid API key and the ability to control the URL used by an API Request component inside a flow. The attacker submits a request to /api/v1/run or /api/v1/run/advanced with a flow that targets an internal endpoint. On AWS deployments, the attacker can retrieve instance metadata, including temporary IAM credentials, from the IMDS endpoint. On internal networks, the attacker can query administrative dashboards, databases, and service APIs that trust requests originating from the Langflow host.

See the GitHub Security Advisory GHSA-5993-7p27-66g5 for additional technical context.

Detection Methods for CVE-2025-68477

Indicators of Compromise

Outbound HTTP requests from the Langflow host to 169.254.169.254 or other link-local addresses
Requests from the Langflow process to RFC 1918 private IP ranges that fall outside expected integration patterns
Flow execution calls to /api/v1/run or /api/v1/run/advanced containing API Request components with internal URLs

Detection Strategies

Inspect Langflow application logs for API Request component invocations and record resolved destination hosts
Correlate API key usage against the diversity of destination hosts contacted by flows
Alert on any egress from the Langflow service account to cloud metadata endpoints

Monitoring Recommendations

Enable network flow logging (VPC Flow Logs or equivalent) on the subnet hosting Langflow and baseline expected destinations
Monitor IAM activity for use of credentials issued through the metadata service from Langflow instances
Track new or modified flows that introduce API Request components with dynamic URL inputs

How to Mitigate CVE-2025-68477

Immediate Actions Required

Upgrade Langflow to version 1.7.0 or later, which contains the patch for this issue
Rotate any API keys and cloud credentials that may have been exposed through the Langflow host
Audit existing flows for API Request components that accept user-controlled URLs

Patch Information

Langflow version 1.7.0 resolves CVE-2025-68477. Refer to the GitHub Security Advisory GHSA-5993-7p27-66g5 for release details and upgrade guidance.

Workarounds

Enforce IMDSv2 on AWS instances to require session tokens for metadata access and reduce SSRF impact
Place Langflow behind an egress proxy that denies traffic to private IP ranges and metadata endpoints
Restrict API key issuance and revoke keys that do not require flow execution access
Remove or disable flows containing API Request components until upgrade is complete

bash

# Example egress deny rules for the Langflow host (iptables)
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT