Live › vulnerability › CVE-2026-102590
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery flaw. A logged-in attacker can make the server send requests to internal or external addresses and obtain sensitive information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted IBM Langflow OSS from 1.0.0 through 1.12.3 where users can log in. The sources do not say which Langflow feature triggers the request, so exposure beyond that version range is unknown. Teams on managed hosting or versions above 1.12.3 can skip it.
No product ranges from the sources yet.
langflow --version or the package manager, and compare against 1.12.3.1.12.3; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-102590")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.