Langflow SSRF via Incomplete Protection Enforcement
First seen Aug 6, 2026 · Updated Aug 6, 2026 · CVSS 6.5
Langflow OSS, a framework used to build AI agent and LLM workflows, contains a server-side request forgery vulnerability caused by incomplete SSRF protections. An attacker able to supply URLs or trigger outbound requests through Langflow components could force the server to reach internal or restricted network resources.
Technical Analysis
The vulnerability stems from SSRF safeguards in Langflow that fail to fully enforce restrictions on outbound HTTP requests initiated by workflow components, likely those handling user-supplied URLs, webhooks, or tool/API-calling nodes. An attacker with the ability to configure or influence a flow's inputs could craft requests directed at internal services, cloud metadata endpoints, or other network-restricted resources, using the Langflow server as a proxy. This crosses a trust boundary by allowing an external or low-privileged actor to pivot into internal network segments via the agent orchestration layer, potentially exposing credentials, internal APIs, or enabling further lateral movement. No indication is given that this is remotely exploitable without some level of interaction with flow configuration or input fields.
Affected Systems
Langflow
Detection Signatures
- Outbound requests from Langflow server to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 127.0.0.1) originating from workflow component execution
- Unexpected HTTP requests to cloud metadata endpoints logged in Langflow server access logs
- User-supplied URL fields in flow configurations pointing to internal hostnames or non-standard ports
- Anomalous request patterns correlating with flow save/execute events
Remediation Steps
- 1
Upgrade Langflow
Update to a patched Langflow version beyond 1.10.3 once available that fully enforces SSRF protections.
- 2
Network segmentation
Restrict outbound network access from the Langflow server host so it cannot reach internal metadata services, management interfaces, or other sensitive internal endpoints.
- 3
Input validation on URL fields
Apply allowlisting for permitted destination hosts/schemes on any component that accepts user-supplied URLs, and reject requests to private/link-local IP ranges.
- 4
Least privilege deployment
Run Langflow with minimal IAM/cloud permissions and disable or firewall cloud metadata endpoint access from the instance.
- 5
Monitor and audit
Enable logging of outbound HTTP requests initiated by workflow execution and alert on requests to internal or reserved IP ranges.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.