{"id":"CVE-2026-104331","kind":"vulnerability","aliases":["CVE-2026-104331"],"related":[],"title":"Langflow: authenticated users can make the server send unauthorized requests","description":"IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 have a server-side request forgery flaw. An logged-in attacker can make the server send requests to internal or external addresses, enabling network enumeration or pivoting to other attacks.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Langflow version with `pip show langflow` or the image tag in your deployment\n- Confirm whether any version in the range 1.0.0 through 1.12.3 is running","fix":"- Move Langflow OSS past `1.12.3`; the sources do not name the exact fixed version","status":"open","published_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:31:45+00:00","updated_at":"2026-10-29T16:31:45+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:31:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move Langflow OSS past `1.12.3`; the sources do not name the exact fixed version\n- unknown for any other setting","reach":"network","title":"Langflow: authenticated users can make the server send unauthorized requests","impact":"medium","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 have a server-side request forgery flaw. An logged-in attacker can make the server send requests to internal or external addresses, enabling network enumeration or pivoting to other attacks.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server sends requests to internal network targets on attacker's behalf","analyst_note":"Find the IBM advisory and the fixed version number, and which Langflow features trigger the outbound request.","how_to_check":"- Check the installed Langflow version with `pip show langflow` or the image tag in your deployment\n- Confirm whether any version in the range 1.0.0 through 1.12.3 is running\n- unknown for other exposure checks: the sources do not say which features or endpoints are affected","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM Langflow OSS from 1.0.0 through 1.12.3 where users can log in. The sources do not say which features or endpoints make it reachable, so exposure depends on the deployment. Instances with no user accounts or only trusted users are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4124,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104331':13A,16A '-2026':12A,15A '1.0.0':29B,67C '1.12.3':31B,69C 'address':55B 'ai':18B 'ai-tool':17B 'allow':81C 'attack':44B,63B,84C,100C 'authent':2A,83C 'cve':11A,14A 'enabl':56B 'enumer':58B,96C 'extern':54B 'facilit':98C 'flaw':39B 'forgeri':38B,77C 'host':24B 'ibm':25B,64C 'intern':52B 'langflow':1A,20B,26B,65C 'lead':93C 'log':42B 'logged-in':41B 'make':5A,46B 'may':80C 'network':57B,95C 'oss':27B,66C 'pivot':60B 'potenti':92C 'python':21B 'request':10A,37B,50B,76C,88C 'self':23B 'self-host':22B 'send':8A,49B,86C 'server':7A,35B,48B,74C 'server-sid':34B,73C 'side':36B,75C 'ssrf':78C 'system':91C 'tool':19B 'unauthor':9A,87C 'user':3A 'version':28B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Langflow OSS from 1.0.0 through 1.12.3 where users can log in. The sources do not say which features or endpoints make it reachable, so exposure depends on the deployment. Instances with no user accounts or only trusted users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104331","severity":null,"published_at":"2026-10-29T16:17:44+00:00","modified_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}