CVE-2026-81265
Analyzed Analyzed - Analysis Complete

IBM Langflow OSS Remote Code Execution Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-16

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.11.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-16
Generated
2026-10-01
AI Q&A
2026-09-11
EPSS Evaluated
2026-09-29
NVD
CVE-2026-81265
EUVD
EUVD-2026-75778

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
langflow langflow From 1.0.0 (inc) to 1.11.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a vulnerability that allows unauthorized access to sensitive information due to improper access controls. The CVSS score of 7.5 indicates a high severity issue with network-based attack vector and no privileges required.

Detection Guidance

To detect this SSRF vulnerability in IBM Langflow OSS, check if your system is running versions 1.0.0 through 1.11.5. Inspect network logs for unusual outbound requests from Langflow components like MCP server, DataStax Astra DB, or OpenAI Chat Model. Monitor for unauthorized access to internal resources or external hosts.

Impact Analysis

This vulnerability could allow attackers to access confidential data without authentication. Impact includes potential data breaches, loss of sensitive information, and compromise of system integrity. The high confidentiality impact (C:H) means sensitive data could be exposed.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The description only mentions the affected software versions and CVSS scores without detailing potential compliance impacts.

Mitigation Strategies

Upgrade IBM Langflow OSS to a version beyond 1.11.5 to address the vulnerability. If immediate upgrade is not possible, restrict network access to the affected system and monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81265. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart