CVE-2026-12766: IBM Langflow OSS SSRF Vulnerability

CVE-2026-12766 Overview

CVE-2026-12766 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.11.2. The flaw allows an authenticated attacker to coerce the Langflow server into issuing unauthorized outbound requests to attacker-chosen destinations. Successful exploitation can enable internal network enumeration, reconnaissance of adjacent services, and staging of follow-on attacks against systems normally unreachable from the internet. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An authenticated attacker can pivot through the Langflow server to probe internal networks, access cloud metadata endpoints, or interact with services that trust requests originating from the application host.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.2
Deployments exposing Langflow to authenticated but untrusted users
Langflow instances hosted alongside sensitive internal services or cloud metadata APIs

Discovery Timeline

2026-09-14 - CVE-2026-12766 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-12766

Vulnerability Analysis

IBM Langflow OSS is a visual framework used to build agentic and retrieval-augmented generation workflows on top of language models. The affected releases accept user-supplied URLs in components that fetch external content, but fail to enforce sufficient restrictions on the destination host, scheme, or resolved IP address. An authenticated user with permission to build or execute flows can direct the server to issue arbitrary HTTP requests. Because the request originates from the Langflow host, it inherits any implicit trust granted to that host by the surrounding network.

Root Cause

The root cause is missing or incomplete validation of URLs before the server dereferences them, matching the pattern described by CWE-918. The application does not enforce an allow-list of destinations, does not block requests to loopback, link-local, or private RFC1918 ranges, and does not re-validate hostnames after DNS resolution. This gap allows attackers to bypass network segmentation controls that depend on source-IP trust.

Attack Vector

Exploitation requires network access to the Langflow API and low-privileged authenticated credentials. The attacker submits a flow or component configuration containing a crafted URL pointing at an internal target, such as http://169.254.169.254/ for cloud instance metadata or http://127.0.0.1:<port> for locally bound admin services. When the flow executes, Langflow issues the request and returns response data, timing, or error content that reveals whether the internal endpoint exists. See the IBM Support advisory for vendor guidance.

No public proof-of-concept exploit is available at this time.

Detection Methods for CVE-2026-12766

Indicators of Compromise

Outbound HTTP requests from the Langflow host to RFC1918 addresses, 127.0.0.0/8, or cloud metadata IPs such as 169.254.169.254
Flow definitions or component parameters containing URLs referencing internal hostnames, non-HTTP schemes, or IP literals
Unexpected authentication attempts or connection floods originating from the Langflow server address

Detection Strategies

Inspect Langflow application logs for URL parameters submitted to fetch or HTTP-client components and flag non-public destinations
Correlate proxy and firewall egress logs with Langflow process activity to surface requests to internal ranges
Alert on repeated connection attempts from Langflow to sequential internal ports, which indicates network enumeration

Monitoring Recommendations

Route all Langflow outbound traffic through an egress proxy that enforces destination allow-listing and logs full URLs
Enable audit logging for user actions that create or modify flows, and retain the payloads for review
Monitor cloud metadata endpoint access on the Langflow host and treat any hit as a high-severity event

How to Mitigate CVE-2026-12766

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release as identified in the IBM Support advisory
Restrict Langflow account provisioning and enforce least-privilege access for users able to author or execute flows
Place Langflow deployments in a network segment that cannot reach cloud metadata services or internal administrative interfaces

Patch Information

IBM has published remediation guidance on the IBM Support Page for node 7285639. Administrators should apply the vendor-recommended upgrade to a version later than 1.11.2 and validate that URL-fetching components enforce destination restrictions after the update.

Workarounds

Block egress from the Langflow host to 169.254.169.254, 127.0.0.0/8, and internal RFC1918 ranges at the network layer
Require IMDSv2 with hop-limit 1 on AWS instances hosting Langflow to prevent metadata theft via SSRF
Disable or remove Langflow components that perform arbitrary outbound HTTP requests where they are not required for business workflows

bash

# Example egress restriction using iptables on the Langflow host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner langflow -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner langflow -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner langflow -j REJECT