Live › vulnerability › CVE-2026-104331
IBM Langflow OSS versions 1.0.0 through 1.12.3 have a server-side request forgery flaw. An logged-in attacker can make the server send requests to internal or external addresses, enabling network enumeration or pivoting to other attacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running IBM Langflow OSS from 1.0.0 through 1.12.3 where users can log in. The sources do not say which features or endpoints make it reachable, so exposure depends on the deployment. Instances with no user accounts or only trusted users are lower risk.
No product ranges from the sources yet.
pip show langflow or the image tag in your deployment1.12.3; the sources do not name the exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-104331")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.