Live › vulnerability › CVE-2026-104315
IBM Langflow OSS versions 1.0.0 through 1.12.3 have a server-side request forgery flaw. A logged-in attacker can make the server send requests to other systems, which can expose internal network details or help with further attacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running IBM Langflow OSS in the affected range where users have accounts on the instance. The sources say an authenticated attacker is required; they do not describe the specific features or configuration that expose it.
No product ranges from the sources yet.
langflow --version or the package manager, and compare it with the affected range 1.0.0 through 1.12.3.1.12.3; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-104315")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.