{"id":"CVE-2026-104310","kind":"vulnerability","aliases":["CVE-2026-104310"],"related":[],"title":"Langflow: authenticated SSRF lets a user read internal server information","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 have a server-side request forgery flaw. A logged-in user can make the server send requests to addresses they choose, which can expose sensitive information.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"langflow","fixed":["1.12.4"],"affected":">= 1.0.0, <= 1.12.3","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Run pip show langflow or langflow --version. Versions 1.0.0 through 1.12.3 are affected; 1.12.4 or later is fixed.","fix":"Upgrade Langflow OSS to 1.12.4 or later (IBM bulletin names 1.12.4; no workaround listed).","status":"open","published_at":"2026-10-29T16:17:43+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:32:02+00:00","updated_at":"2026-10-29T16:32:37+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-29T16:32:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Langflow: authenticated SSRF lets a user read internal server information","impact":"medium","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 have a server-side request forgery flaw. A logged-in user can make the server send requests to addresses they choose, which can expose sensitive information.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server makes internal requests and leaks sensitive information","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for Langflow OSS; the NVD entry alone does not state one.","how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`.\n- Confirm whether the version falls in `1.0.0` through `1.12.3`.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Teams running self-hosted Langflow OSS in the affected version range are exposed. The flaw requires an authenticated account, so instances where only trusted users can sign in carry less risk. Managed or hosted Langflow deployments are not described by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4105,"output_tokens":510,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for Langflow OSS; the NVD entry alone does not state one.","search":"'-104310':13A,16A '-2026':12A,15A '1.0.0':30B,64C '1.12.3':32B,66C 'address':53B 'ai':19B 'ai-tool':18B 'allow':68C 'attack':72C 'authent':2A,71C 'choos':55B 'could':67C 'cve':11A,14A 'due':77C 'expos':58B 'flaw':40B 'forgeri':39B,84C 'host':25B 'ibm':26B,61C 'inform':10A,60B,76C 'intern':8A 'langflow':1A,17A,21B,27B,62C 'let':4A 'log':43B 'logged-in':42B 'make':47B 'obtain':74C 'oss':28B,63C 'python':22B 'read':7A 'remot':70C 'request':38B,51B,83C 'self':24B 'self-host':23B 'send':50B 'sensit':59B,75C 'server':9A,36B,49B,81C 'server-sid':35B,80C 'side':37B,82C 'ssrf':3A,85C 'tool':20B 'user':6A,45B 'version':29B 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Langflow OSS in the affected version range are exposed. The flaw requires an authenticated account, so instances where only trusted users can sign in carry less risk. Managed or hosted Langflow deployments are not described by the sources.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:32:37Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0","run_id":1057},"products":{"at":"2026-10-29T16:32:37Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0","run_id":1057},"workarounds":{"at":"2026-10-29T16:32:37Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0","run_id":1057},"how_to_check":{"at":"2026-10-29T16:32:37Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0","run_id":1057}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104310","severity":null,"published_at":"2026-10-29T16:17:43+00:00","modified_at":"2026-10-29T16:17:43+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104310:1057","url":null,"severity":null,"published_at":"2026-10-29T16:32:37+00:00","modified_at":"2026-10-29T16:32:37+00:00","first_seen_at":"2026-10-29T16:32:37+00:00","fetched_at":"2026-10-29T16:32:37+00:00","note":"IBM bulletin (19 Oct 2026) lists this CVE; affected Langflow OSS 1.0.0-1.12.3, fix 1.12.4, no workarounds. Bulletin gives no component detail. A later IBM bulletin names 1.12.5 for other CVEs."}],"documents":[{"id":17743,"url":"https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0","title":"IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (19 Oct 2026)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}