CVE-2026-10129 Overview
CVE-2026-10129 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.3. The flaw resides in the API Request component and allows an authenticated attacker holding the flow author role to bypass SSRF protections by enabling the follow_redirects parameter. The application validates only the initial URL and fails to re-validate redirect destinations, letting attackers pivot to internal HTTP services, localhost endpoints, cloud metadata services, and private network resources [CWE-918].
Critical Impact
Authenticated attackers can reach internal-only endpoints and cloud metadata services, exposing credentials, tokens, internal API responses, and administrative panel data.
Affected Products
- IBM Langflow OSS 1.0.0 through 1.9.3
- Langflow API Request component
- Deployments relying on Langflow's built-in SSRF protection
Discovery Timeline
- 2026-06-30 - CVE-2026-10129 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-10129
Vulnerability Analysis
Langflow's API Request component ships with SSRF protection that inspects the target URL before dispatching a request. When the follow_redirects parameter is enabled, the HTTP client transparently follows 3xx responses returned by the destination server. The vulnerability exists because Langflow validates the initial URL against its SSRF allowlist but does not re-apply that validation to redirect targets. An attacker supplies a public URL under their control that returns a redirect pointing to 127.0.0.1, 169.254.169.254, or another private-network address. The HTTP client follows the redirect and returns the internal response to the attacker.
Exploitation requires authenticated access with the flow author role, which is a low privilege in Langflow deployments. The attacker can craft or modify a flow that invokes the API Request component with an attacker-controlled URL. The impact scope changes because the request is issued by the Langflow server process, giving the attacker access to resources bound to the server's network position.
Root Cause
The root cause is incomplete input validation during the HTTP redirect chain. SSRF checks execute once against the user-supplied URL. The underlying HTTP library then follows any Location headers without re-invoking the allowlist logic, breaking the security control's assumption that all outbound destinations are validated.
Attack Vector
The attack vector is network-based and requires authentication. An attacker with flow author privileges configures an API Request node with follow_redirects=true and a target URL such as https://attacker.example/redirect. The attacker's server responds with an HTTP 302 redirect whose Location header points at an internal resource, for example the AWS Instance Metadata Service at http://169.254.169.254/latest/meta-data/iam/security-credentials/. Langflow follows the redirect and returns the internal response body to the attacker through the flow output.
No verified public proof-of-concept code exists for this vulnerability. Refer to the IBM Support Page for authoritative technical details.
Detection Methods for CVE-2026-10129
Indicators of Compromise
- Outbound HTTP requests from the Langflow server to public URLs immediately followed by internal requests to 127.0.0.1, 169.254.169.254, or RFC1918 addresses.
- Flow definitions containing API Request components with follow_redirects set to true and unusual external targets.
- Access log entries on internal services showing requests originating from the Langflow server's IP with no corresponding user activity.
Detection Strategies
- Audit stored Langflow flow definitions for API Request nodes where follow_redirects is enabled, and review the associated destination URLs.
- Inspect HTTP client logs from the Langflow process for 3xx responses followed by requests to loopback, link-local, or private IP ranges.
- Correlate flow author authentication events with subsequent outbound traffic to attacker-controlled domains.
Monitoring Recommendations
- Enable egress logging on the Langflow host and alert on connections to cloud metadata endpoints such as 169.254.169.254 and metadata.google.internal.
- Monitor for anomalous DNS queries from the Langflow server resolving to internal or reserved address ranges.
- Track changes to flow definitions and privilege assignments for the flow author role via configuration audit logs.
How to Mitigate CVE-2026-10129
Immediate Actions Required
- Upgrade IBM Langflow OSS to a fixed release as documented in the IBM Support Page.
- Restrict flow author role assignments to trusted users until patching is complete.
- Block outbound traffic from the Langflow server to cloud metadata endpoints and internal management networks at the host or network firewall.
Patch Information
IBM has published remediation guidance for Langflow OSS covering versions 1.0.0 through 1.9.3. Consult the IBM Support Page for the fixed version and upgrade instructions.
Workarounds
- Disable the API Request component or prevent flow authors from setting follow_redirects=true where configuration allows.
- Deploy Langflow inside a network segment with no route to cloud metadata services or sensitive internal APIs.
- Enforce an egress proxy that re-validates every HTTP destination, including redirect targets, against an allowlist.
# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner langflow -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
