CVE-2026-9081 Overview
CVE-2026-9081 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw resides in the validate_model_provider_key() function used by the Ollama provider integration. This function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation. The absence of scheme enforcement, host allowlisting, or filtering of private IP ranges enables authenticated attackers to coerce the Langflow server into issuing arbitrary HTTP requests. This vulnerability is categorized under [CWE-918].
Critical Impact
Authenticated attackers can force the Langflow backend to reach internal services, cloud metadata endpoints, and loopback interfaces, exposing sensitive infrastructure data.
Affected Products
- IBM Langflow OSS 1.0.0 through 1.10.3
- Ollama provider integration within Langflow
- Deployments exposing the validate_model_provider_key() endpoint to authenticated users
Discovery Timeline
- 2026-08-05 - CVE CVE-2026-9081 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-9081
Vulnerability Analysis
The vulnerability lives in the Ollama provider's key validation routine. When a user configures an Ollama model provider, Langflow calls validate_model_provider_key() to test connectivity against the URL supplied in OLLAMA_BASE_URL. The function forwards the raw user input to requests.get() and returns responses to the caller. Attackers with authenticated access can substitute internal URLs, cloud metadata endpoints such as http://169.254.169.254/, or loopback addresses like http://127.0.0.1:port. The server issues these requests from its own network position, bypassing perimeter controls. Because Langflow runs in cloud and container environments, SSRF frequently yields Instance Metadata Service (IMDS) tokens, internal API responses, and reachable service enumeration data.
Root Cause
The root cause is missing input validation on the OLLAMA_BASE_URL parameter. The provider validation logic performs no scheme allowlisting (only permitting http/https against expected hosts), no DNS resolution checks against RFC1918, loopback, or link-local ranges, and no host allowlist enforcement. User-controlled data flows directly into an outbound HTTP client.
Attack Vector
An authenticated attacker with low privileges submits a crafted OLLAMA_BASE_URL value pointing to an internal target. Langflow invokes requests.get() against that URL and returns response data or error signals to the attacker. The attacker chains this behavior to enumerate internal services, read cloud metadata, or interact with unauthenticated internal APIs reachable from the Langflow host.
No verified proof-of-concept code is publicly available. See the IBM Support Page for vendor technical details.
Detection Methods for CVE-2026-9081
Indicators of Compromise
- Outbound HTTP requests from the Langflow process to 169.254.169.254, 127.0.0.1, or RFC1918 addresses that do not match legitimate Ollama endpoints.
- Langflow application logs recording OLLAMA_BASE_URL values referencing internal hosts, loopback interfaces, or non-standard schemes.
- Unexpected 4xx/5xx response patterns from validate_model_provider_key() correlated with internal service ports.
Detection Strategies
- Instrument the Langflow container to log all outbound HTTP destinations from requests sessions and alert on private IP ranges.
- Correlate authenticated Langflow user actions with outbound network flows to identify SSRF probing patterns.
- Deploy egress filtering telemetry that flags Langflow-originated connections to cloud metadata services.
Monitoring Recommendations
- Monitor Langflow audit logs for provider-key validation attempts referencing unusual hosts.
- Track network egress from Langflow pods and hosts to detect connections outside the expected Ollama service scope.
- Alert on repeated failed validation calls, which may indicate SSRF enumeration.
How to Mitigate CVE-2026-9081
Immediate Actions Required
- Upgrade IBM Langflow OSS beyond version 1.10.3 once a fixed release is available per the IBM Support Page.
- Restrict authenticated access to Langflow to trusted operators only until patched.
- Apply strict egress network policies preventing Langflow workloads from reaching cloud metadata endpoints and internal management interfaces.
Patch Information
Refer to the IBM Support Page for the vendor's remediation guidance and fixed version details. Administrators should review release notes for versions superseding 1.10.3.
Workarounds
- Enforce network-level egress allowlisting so Langflow can only reach approved Ollama endpoints.
- Deploy an outbound proxy that blocks requests to loopback, RFC1918, and link-local address ranges.
- Disable or restrict the Ollama provider configuration for non-administrator users.
- Require IMDSv2 with hop-limit 1 on AWS deployments to reduce cloud metadata exposure via SSRF.
# Example egress restriction using iptables to block metadata and loopback abuse from the Langflow container
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
