Vulnerabilities

TI-2026-10914 CVE-2026-12767 · GHSA-jvmc-mxmx-5qwq

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

LOW 35

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00294 Published 2026-09-14 No fix listed CWE-918

TI-2026-55208 CVE-2026-79723 · GHSA-xxgw-78f3-7q6j

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

LOW 23

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00363 Published 2026-09-10 No fix listed CWE-918

TI-2026-56098 CVE-2026-81213 · GHSA-hq58-536x-mhhx

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

MEDIUM 44

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00488 Published 2026-09-10 No fix listed CWE-918

TI-2026-56105 CVE-2026-81265 · GHSA-j99h-p584-x29h

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

LOW 39

IBM Langflow OSS 1.0.0 through 1.11.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-09-10 No fix listed CWE-918

Vulnerabilities

Filters

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches