Langflow SSRF via Incomplete Protection Enforcement
First seen Jul 18, 2026 · Updated Jul 18, 2026 · CVSS 7.7
Langflow, an open-source framework used to build AI agent workflows, contains a server-side request forgery vulnerability caused by weak default configuration and incomplete SSRF protections. An attacker could exploit this to make the Langflow server issue unauthorized requests to internal or cloud-metadata endpoints, potentially exposing sensitive infrastructure or credentials. This is a genuine, credibly documented vulnerability (CVSS 7.7) rather than a speculative or low-quality report.
Technical Analysis
Langflow allows agent workflows to define components (e.g., HTTP request nodes, tool integrations, webhook fetchers) that make outbound network calls on behalf of the server. The described flaw indicates that the SSRF protection mechanism intended to restrict these outbound calls to safe destinations is either disabled by default or can be bypassed, allowing an attacker who controls workflow input (URLs, node parameters) to force the server to reach internal-only services, loopback addresses, or cloud metadata endpoints (e.g., 169.254.169.254). Entry point is any user-facing or API-facing component that accepts a URL/host parameter processed by the Langflow backend. Successful exploitation can leak cloud IAM credentials, expose internal service banners/APIs, or serve as a pivot to attack other agents/tools reachable only from the Langflow host's network position. This crosses the tool/agent boundary because Langflow orchestrates multiple downstream tools and agent components, so an SSRF foothold on the orchestrator can be leveraged to reach or impersonate calls to internal agent services normally isolated from external attackers.
Affected Systems
IBM Langflow OSS
Detection Signatures
- Outbound requests from Langflow host to RFC1918 addresses (10.x, 172.16-31.x, 192.168.x) or loopback (127.0.0.1, 0.0.0.0)
- Requests to cloud metadata IP 169.254.169.254 originating from Langflow process
- Workflow/component configs containing attacker-supplied URLs pointing to internal hostnames or IP literals
- Unexpected DNS resolution requests to non-public or newly registered domains from the Langflow server
- HTTP request-building components (webhook, fetch-URL, tool nodes) invoked with unexpected schemes (file://, gopher://, dict://)
Remediation Steps
- 1
Upgrade Langflow
Update to the patched Langflow version beyond 1.10.0 / 1.9.0 that fully enforces SSRF protections, per vendor advisory.
- 2
Enforce network egress controls
Apply firewall/network policies restricting the Langflow server's outbound access to only required external services; block access to link-local metadata addresses and internal RFC1918 ranges by default.
- 3
Harden default configuration
Explicitly enable and verify SSRF protection settings rather than relying on defaults; audit configuration against vendor security guidance.
- 4
Validate and allowlist URLs in workflow components
Implement strict allowlisting of destination hosts/schemes for any component that accepts user-supplied URLs, rejecting internal IP ranges and non-HTTP(S) schemes.
- 5
Isolate orchestrator from sensitive services
Run Langflow in a segmented network zone without direct reachability to cloud metadata services or sensitive internal agent APIs, using IMDSv2 or metadata service hardening where applicable.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.