Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

IBM Langflow OSS can be tricked into making external requests

CVE-2026-12767 · published 1 month ago
Summary

Versions 1.0.0 through 1.11.5 of IBM Langflow OSS allow anyone on the internet to make the application send its own network requests. This could let an attacker discover internal services or use the system to reach other targets. Update to a newer version or apply the vendor’s patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm langflow oss <= 1.11.5
Original advisory text
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially lead...
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published14 Sep 2026
Updated4 Nov 2026
First seen14 Sep 2026
Sources
CVE-2026-12767 · NVD
CVE-2026-12767 · MITRE
Track software like this
Free during beta