CVE-2026-10564
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM Langflow OSS versions 1.0.0 through 1.9.6 contain a Server-Side Request Forgery (SSRF) vulnerability. The RSSReaderComponent and SearXNG components make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3.
Risk Assessment
An authenticated attacker can exploit this to access internal resources, including cloud metadata services (AWS/Azure/GCP IMDS), potentially exfiltrating IAM credentials and enumerating internal networks. The vulnerability can also be triggered through prompt injection in agentic workflows.
Recommendation
Immediately upgrade IBM Langflow OSS to version 1.9.7 or later, which includes a fix for the SSRF vulnerability. Additionally, restrict access to the RSSReaderComponent and SearXNG components and monitor network traffic for suspicious HTTP requests.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-19295Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 allow an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allows privilege escalation from 'authenticated flow user' to arbitrary OS-level command execution, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy.
- CVE-2026-19286Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
- CVE-2026-19297Critical
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
- CVE-2026-12946Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.
- CVE-2026-13435Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation vulnerability in the PythonREPL sandbox implementation.
- CVE-2026-12940Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP stdio launcher. The vulnerability is due to an incomplete blocklist of dangerous environment variables (missing SHELLOPTS, BASHOPTS, and PS4) in src/lfx/src/lfx/base/mcp/util.py.
- CVE-2026-13446Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication, or internal data encryption.
- CVE-2026-8635Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
- CVE-2026-8505Critical
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).
- CVE-2026-8481Critical
Critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 in the /api/v1/validate/code endpoint. Allows an authenticated attacker to execute arbitrary Python code on the server without sandboxing, leading to remote code execution.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), potentially exfiltrating IAM credentials and enumerating internal networks. The vulnerability can also be triggered through prompt injection in agentic workflows due to tool_mode=True exposure.