CVE-2026-12765: IBM Langflow OSS SSRF Vulnerability

CVE-2026-12765 Overview

CVE-2026-12765 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.2. An unauthenticated attacker can coerce the application into issuing arbitrary outbound HTTP requests from the server. This enables internal network enumeration, access to cloud metadata endpoints, and pivoting toward internal services otherwise unreachable from the internet. The flaw is classified under CWE-918: Server-Side Request Forgery and is exploitable over the network without user interaction or authentication.

Critical Impact
Unauthenticated attackers can abuse Langflow to send arbitrary requests from the host, exposing internal services and enabling reconnaissance across otherwise segmented networks.

Affected Products

IBM Langflow OSS 1.0.0
IBM Langflow OSS versions between 1.0.0 and 1.10.2
IBM Langflow OSS 1.10.2

Discovery Timeline

2026-09-14 - CVE-2026-12765 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-12765

Vulnerability Analysis

IBM Langflow OSS is an open-source visual framework for building LLM-driven workflows. The affected releases accept attacker-controlled URLs and dispatch outbound requests without adequate destination validation. Because the request originates from the Langflow server, the source IP is trusted by internal systems and cloud provider metadata services.

The attack requires no authentication or user interaction and can be executed remotely. Successful exploitation yields limited confidentiality and integrity impact on data returned via server responses. The vulnerability does not directly disrupt availability but can amplify follow-on attacks by mapping internal infrastructure.

Root Cause

The root cause is insufficient validation of user-supplied URLs passed to server-side HTTP client functionality. Langflow does not enforce an allowlist of destinations or block requests to reserved IP ranges, loopback interfaces, or cloud metadata endpoints such as 169.254.169.254. This aligns with the pattern described in [CWE-918].

Attack Vector

An attacker submits a crafted request to a Langflow endpoint that accepts a URL parameter. Langflow then issues an HTTP request to the attacker-specified target from the server context. Targets can include internal RFC1918 addresses, cloud provider Instance Metadata Service (IMDS) endpoints, and administrative interfaces bound to localhost.

No verified public exploit code is available. Refer to the IBM Support advisory for node 7285644 for authoritative technical details.

Detection Methods for CVE-2026-12765

Indicators of Compromise

Outbound HTTP requests from the Langflow server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not part of normal workflow activity.
Requests from Langflow to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Anomalous request patterns targeting localhost, 127.0.0.1, or ::1 originating from the Langflow application process.

Detection Strategies

Inspect Langflow application logs for URL parameters referencing internal ranges, link-local addresses, or non-HTTP schemes such as file:// and gopher://.
Correlate egress firewall logs with Langflow process activity to identify unexpected destinations.
Deploy web application firewall rules that flag inbound requests carrying URLs pointing to reserved or private address space.

Monitoring Recommendations

Enable network flow monitoring on the Langflow host and alert on connections to metadata services and internal management interfaces.
Track DNS queries from the Langflow server for domains resolving to private or link-local addresses.
Review authentication logs on internal services for requests sourced from the Langflow host IP.

How to Mitigate CVE-2026-12765

Immediate Actions Required

Upgrade IBM Langflow OSS to a version later than 1.10.2 as directed by the IBM Support advisory.
Restrict Langflow egress traffic at the network layer to only the destinations required for legitimate workflows.
Block Langflow access to cloud instance metadata endpoints, including 169.254.169.254, using host firewall rules or network policy.

Patch Information

IBM has published remediation guidance on the IBM Support page for node 7285644. Administrators should apply the vendor-supplied fixed release and verify the deployed version is above 1.10.2 before returning the service to production.

Workarounds

Place Langflow behind an authenticated reverse proxy so unauthenticated network access to vulnerable endpoints is not exposed.
Deploy an egress proxy that enforces a destination allowlist and rejects requests to private, loopback, and link-local addresses.
Configure IMDSv2 with hop-limit 1 on AWS-hosted deployments to reduce the impact of SSRF against instance metadata.

bash

# Example iptables rules blocking Langflow egress to metadata and internal ranges
iptables -A OUTPUT -m owner --uid-owner langflow -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner langflow -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner langflow -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner langflow -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner langflow -d 192.168.0.0/16 -j DROP