CVE-2026-12766

A signed-in Langflow user can direct requests into the server’s reachable network

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

IBM reports that a signed-in caller can cause Langflow to send requests to unauthorized destinations.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed IBM bulletin and CNA record do not document malicious exploitation or an affected customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A user-controlled destination escapes the server’s request restrictions. The exact component and bypass are not resolved for this CVE by the grouped bulletin.

Conditions required

The caller is authenticated and the Langflow service can reach the chosen destination.

Potential impact

Possible network enumeration and unauthorized server-side requests. Read access to a named database or metadata service has not been established for this ID.

Affected versions and configurations

1.0.0 through 1.11.2, inclusive, according to IBM.

Fix and mitigation status

1.11.3 addresses this issue according to IBM.

Practical next steps

Upgrade to a supported release containing the 1.11.3 fix. Constrain service egress and test URL checks after redirects and destination resolution.

Operating lesson

Exercise the effective outbound destination with a low-privilege account.

Evidence and limits

IBM’s August 28 bulletin groups several SSRF mechanisms, including URL parsing and database connection options. It was modified September 28. The September 14 CNA confirms the authenticated prerequisite and version range without binding this CVE to one particular component.

Sources