Vulnerabilities

TI-2026-15744 CVE-2026-19301 · GHSA-55jv-gc65-vxhp

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

LOW 29

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00394 Published 2026-09-04 No fix listed CWE-918

TI-2026-15747 CVE-2026-19304 · GHSA-vw5f-qmfc-5q4v

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

LOW 34

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00422 Published 2026-09-04 No fix listed CWE-918

TI-2026-15748 CVE-2026-19305 · GHSA-g569-3cp3-jxr8

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

MEDIUM 44

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00488 Published 2026-09-04 No fix listed CWE-918

Vulnerabilities

Filters

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components