CVE-2026-12766

Received Received - Intake

IBM Langflow SSRF Vulnerability in Versions 1.0.0 to 1.11.2

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-12766

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow	From 1.0.0 (inc) to 1.11.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.11.2 have a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker to send unauthorized requests from the affected system. The attacker could exploit this to interact with internal systems or services that are not directly accessible from outside the network.

Detection Guidance

To detect SSRF vulnerabilities like CVE-2026-12766 in IBM Langflow OSS, monitor network traffic for unusual outbound requests from the application server. Check logs for requests to internal or external systems that the application should not access. Use tools like tcpdump or Wireshark to capture and analyze network traffic for suspicious patterns.

Impact Analysis

If you are using IBM Langflow OSS in the affected versions, an attacker with valid credentials could use this vulnerability to perform network reconnaissance or launch further attacks against internal systems. This could lead to unauthorized access to sensitive data or services within your network.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or data exfiltration, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions must assess the risk of data exposure and take corrective action to maintain compliance.

Mitigation Strategies

Update IBM Langflow OSS to a version beyond 1.11.2 to address the SSRF vulnerability. If immediate update is not possible, restrict network access to the affected system and monitor for unauthorized requests.

Hi! I’m here to help you understand CVE-2026-12766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70