CVE-2026-81213

Received Received - Intake

IBM Langflow OSS URL Redirection Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-81213

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow_oss	From 1.0.0 (inc) to 1.11.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.11.5 have a vulnerability where a remote attacker can access sensitive information from internal network resources. This happens because the software does not properly validate user-supplied URLs.

Detection Guidance

This vulnerability involves improper URL validation that could expose internal network resources. Detection requires monitoring for unusual outbound requests or unexpected data exposure. Check application logs for requests to internal IPs or sensitive endpoints. Use network scanning tools like nmap to identify unexpected open ports or services. Inspect proxy or firewall logs for anomalous traffic patterns.

Impact Analysis

An attacker could exploit this to steal confidential data from internal systems, leading to data breaches, unauthorized access, or further network compromise. The high CVSS score indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update IBM Langflow OSS to version 1.11.6 or later to address the improper URL validation issue. Ensure network segmentation to restrict access to internal resources from external connections. Monitor network traffic for unusual requests targeting internal systems.

Hi! I’m here to help you understand CVE-2026-81213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70