CVE-2026-10546 Overview
CVE-2026-10546 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.9.3. The flaw resides in the URL component located at src/lfx/src/lfx/components/data_source/url.py. A Time-of-Check/Time-of-Use (TOCTOU) race condition allows attackers to bypass URL validation using DNS rebinding techniques. An attacker can force the Langflow server to issue requests to internal network resources that would otherwise be blocked by host allow-list checks. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Successful exploitation lets remote unauthenticated attackers coerce the Langflow server into accessing internal services, exposing confidential data reachable from the application host.
Affected Products
- IBM Langflow OSS 1.0.0 through 1.9.3
- langflow URL data source component (src/lfx/src/lfx/components/data_source/url.py)
- Deployments exposing Langflow endpoints to untrusted networks
Discovery Timeline
- 2026-06-30 - CVE-2026-10546 published to the National Vulnerability Database
- 2026-07-02 - Last updated in the NVD database
Technical Details for CVE-2026-10546
Vulnerability Analysis
The URL data source component validates a user-supplied URL by resolving the hostname and confirming that the resulting IP address is not internal or otherwise disallowed. After this validation, the component issues an HTTP request using the original hostname. The two operations are not atomic. Between the validation resolution and the subsequent request, DNS records for the attacker-controlled hostname can change. This gap is the core weakness classified under [CWE-918].
An attacker hosts a DNS zone that alternates responses between a public IP address and an internal IP address such as 127.0.0.1, 169.254.169.254, or an RFC 1918 range. When Langflow validates the hostname, the resolver returns the benign public address. When Langflow subsequently fetches the URL, the resolver returns the internal address, satisfying the check but hitting the restricted target.
Exploitation requires the attacker to control DNS responses and win a timing window, which raises attack complexity. Successful exploitation exposes internal HTTP services, cloud metadata endpoints, and other resources reachable from the Langflow host.
Root Cause
The root cause is a Time-of-Check/Time-of-Use race between DNS resolution during validation and DNS resolution during the outbound HTTP request. The url.py component does not pin the validated IP address to the connection, allowing separate lookups to return different addresses.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker submits a URL pointing to a hostname under their control. The authoritative DNS server returns short-TTL records that flip from public to internal addresses. Langflow validates the first response, then connects to the second.
No verified proof-of-concept has been published. Refer to the IBM Support Page for authoritative technical details.
Detection Methods for CVE-2026-10546
Indicators of Compromise
- Outbound DNS queries from Langflow hosts to attacker-controlled domains with unusually low TTL values
- Langflow-initiated HTTP connections to internal RFC 1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254
- Repeated URL component invocations targeting the same external hostname within short time windows
Detection Strategies
- Inspect Langflow application logs for URL component executions where the requested host resolves to multiple distinct IPs across short intervals
- Correlate DNS resolver telemetry with process-level network connections to identify address mismatches between resolution and connection
- Alert on Langflow processes originating traffic to instance metadata services or internal management interfaces
Monitoring Recommendations
- Forward Langflow container and host logs to a centralized SIEM with DNS and network flow enrichment
- Establish a baseline of expected outbound destinations for the Langflow service and flag deviations
- Monitor egress firewall denies from Langflow workloads to internal subnets and metadata IPs
How to Mitigate CVE-2026-10546
Immediate Actions Required
- Upgrade IBM Langflow OSS to a fixed release above 1.9.3 as directed by the IBM Support Page
- Restrict Langflow egress traffic at the network layer to block access to RFC 1918 ranges, loopback, and cloud metadata endpoints
- Audit historical Langflow logs for suspicious URL component activity targeting external short-TTL domains
Patch Information
IBM has published remediation guidance on the IBM Support Page. Apply the vendor-supplied fixed version for Langflow OSS to eliminate the TOCTOU race in the URL component.
Workarounds
- Deploy Langflow behind an egress proxy that enforces IP-based allow-listing after resolution and pins connections to validated addresses
- Disable or restrict the URL data source component when it is not required for workflows
- Block instance metadata service access from Langflow workloads using host firewalls or IMDSv2 hop-limit controls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
