CVE-2026-7657
Received Received - Intake

SSRF Vulnerability in IBM Langflow OSS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-7657
EUVD
EUVD-2026-53567

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm langflow From 1.0.0 (inc) to 1.10.3 (inc)
ibm langflow_oss From 1.0.0 (inc) to 1.10.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7657 is a Server-Side Request Forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. It occurs due to incomplete enforcement of SSRF protections, allowing authenticated users to send unauthorized requests to internal or external network locations. This could expose internal services or resources accessible from the Langflow server.

Detection Guidance

Detecting SSRF vulnerabilities typically involves monitoring network traffic for unauthorized outbound requests from the Langflow server. Check logs for unusual connections to internal or external IPs. Use tools like tcpdump or Wireshark to capture outbound traffic from the Langflow process. Verify if authenticated users can trigger requests to restricted endpoints or cloud metadata services.

Impact Analysis

This vulnerability allows attackers with authenticated access to make unauthorized requests to internal or external systems. It could expose sensitive internal services, cloud metadata, or other resources reachable from the Langflow server, potentially leading to data leaks or further network compromise.

Compliance Impact

SSRF vulnerabilities can lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of internal services or cloud metadata may result in non-compliance with data protection regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade Langflow OSS to version 1.11.0 or later to address the SSRF vulnerability. Ensure no workarounds are applied as IBM does not recommend them. Monitor network traffic for suspicious activity post-upgrade. Restrict user permissions to minimize potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart