CVE-2026-18545: IBM Langflow OSS SSRF Vulnerability

CVE-2026-18545 Overview

CVE-2026-18545 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting IBM Langflow OSS versions 1.0.0 through 1.11.1. Langflow is an open-source framework for building AI agents and workflows. The flaw allows an authenticated attacker to coerce the Langflow server into issuing unauthorized outbound requests. Attackers can leverage this behavior for internal network enumeration, reaching services that would otherwise be unreachable from the public internet, and staging follow-on attacks against adjacent systems.

Critical Impact
An authenticated attacker can abuse Langflow to send arbitrary requests from the server, enabling internal reconnaissance and pivoting against internal infrastructure.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.1
Langflow-based AI workflow deployments exposing authenticated endpoints
Self-hosted Langflow instances integrated with internal services and metadata endpoints

Discovery Timeline

2026-08-28 - CVE-2026-18545 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-18545

Vulnerability Analysis

The vulnerability resides in Langflow's handling of user-supplied URLs within workflow components. Langflow accepts URL parameters from authenticated users and issues outbound HTTP requests without adequately validating the destination. An attacker with authenticated access can point these requests at internal network addresses, loopback services, or cloud metadata endpoints. The server executes the request under its own network identity and returns response data to the attacker, effectively turning Langflow into a proxy into the internal environment.

Root Cause

The root cause is missing or insufficient allowlist validation on outbound request destinations, classified under [CWE-918]. Langflow does not restrict user-provided URLs to expected external endpoints. Requests to private IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 127.0.0.0/8 are not blocked. Cloud metadata services like 169.254.169.254 are similarly reachable when Langflow is deployed on AWS, Azure, or GCP infrastructure.

Attack Vector

Exploitation requires an authenticated account on the target Langflow instance. The attacker submits a workflow or component configuration containing a crafted URL pointing at an internal target. Langflow issues the request from the server host, and the response body, status code, or error content is returned to the attacker. This enables port scanning of internal hosts, fingerprinting of internal services, and potential retrieval of sensitive data such as cloud instance credentials from metadata APIs. Refer to the IBM Support Page for vendor-supplied details.

Detection Methods for CVE-2026-18545

Indicators of Compromise

Outbound HTTP requests from the Langflow host targeting RFC1918 addresses or 169.254.169.254
Langflow application logs showing workflow executions with URL parameters pointing at internal hostnames or IP literals
Unexpected authentication or API calls originating from the Langflow service account against internal services

Detection Strategies

Inspect Langflow request logs for user-supplied URLs whose hostnames resolve to private, loopback, or link-local address ranges
Correlate authenticated Langflow session activity with anomalous outbound connection patterns from the host
Alert on any traffic from Langflow workers to cloud metadata endpoints, which should never occur during normal operation

Monitoring Recommendations

Route Langflow egress through a filtering proxy and log all destinations for forensic review
Baseline normal outbound destinations for Langflow and alert on new or internal targets
Monitor Langflow user accounts for repeated failed workflow executions that may indicate SSRF probing

How to Mitigate CVE-2026-18545

Immediate Actions Required

Upgrade Langflow to a version later than 1.11.1 once IBM publishes a fixed release per the IBM Support Page
Restrict authenticated access to Langflow to trusted users and enforce strong authentication
Deploy Langflow behind an egress firewall that blocks traffic to internal networks and cloud metadata endpoints

Patch Information

IBM has published advisory information on the IBM Support Page. Administrators should apply the fixed release referenced in that advisory and validate that the Langflow deployment no longer permits outbound requests to restricted address ranges.

Workarounds

Place Langflow in a network segment that has no route to internal management interfaces or cloud metadata services
Enforce an egress allowlist limiting Langflow to only the external endpoints required by production workflows
Require IMDSv2 with hop-limit 1 on AWS deployments to prevent metadata credential theft via SSRF

bash

# Example iptables egress restriction for a Langflow host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP