Langflow Ollama Provider SSRF via Unvalidated OLLAMA_BASE_URL

Technical Analysis

The vulnerability resides in validate_model_provider_key(), which accepts an OLLAMA_BASE_URL parameter from the user/agent configuration and calls requests.get() on it without allowlisting schemes, hosts, or filtering private/loopback/link-local IP ranges. An attacker with access to configure a Langflow flow (or an agent/tool acting on their behalf) can set this URL to point at internal services, cloud instance metadata endpoints (e.g., 169.254.169.254), or other loopback-bound admin interfaces. The Langflow backend then issues the request server-side, effectively acting as a proxy for the attacker into the internal network, which can yield credential theft (cloud IAM tokens), internal service enumeration, or pivoting into otherwise unreachable systems. This crosses a trust boundary because the vulnerable code path is invoked as part of agent/tool provider validation logic, meaning any agent or automated pipeline that configures model providers dynamically can be leveraged as an unwitting SSRF vector.

Affected Systems

IBM Langflow OSS

Detection Signatures

• Outbound HTTP requests from Langflow host to RFC1918/loopback/link-local addresses immediately following model provider validation calls
• OLLAMA_BASE_URL values containing IPs such as 127.0.0.1, 169.254.169.254, 10.x.x.x, 192.168.x.x, or non-http(s) schemes (file://, gopher://)
• Unexpected requests to cloud metadata endpoints originating from Langflow process
• Repeated validate_model_provider_key invocations with varying host parameters (probing behavior)

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched Langflow release once available that validates or restricts OLLAMA_BASE_URL to an allowlist of trusted hosts/schemes.

2. 2

   Implement SSRF protections

   Enforce scheme allowlisting (http/https only), block requests to RFC1918, loopback, link-local, and cloud metadata IP ranges before making the outbound request.

3. 3

   Network egress controls

   Restrict outbound network access from the Langflow host via firewall rules so it cannot reach internal management interfaces or cloud metadata services.

4. 4

   Least privilege for provider configuration

   Limit which users/roles can configure model provider base URLs, and audit changes to these settings.

5. 5

   Monitor outbound requests

   Add logging/alerting on outbound HTTP calls triggered by provider validation functions, flagging internal or metadata-range destinations.