CVE-2026-10129: IBM Langflow OSS SSRF Bypass via Redirect Following – HIGH Risk

Technical summary

The vulnerability resides in the API Request component of Langflow OSS and stems from incomplete SSRF validation logic. When the follow_redirects parameter is enabled, an attacker supplies a public URL that performs HTTP 30x redirects to restricted targets (127.0.0.1, internal IP ranges, cloud metadata endpoints like 169.254.169.254). Because the application only validates the initial request URL and not subsequent redirect destinations, the re-validation bypass succeeds. An authenticated user with the flow author role can craft a flow containing this misconfigured request, enabling reconnaissance and exfiltration of sensitive data from otherwise protected endpoints. The vulnerability maps to CWE-918 (Server-Side Request Forgery).

Business impact

Organizations using Langflow OSS in multi-tenant or shared environments face credential and data compromise risks. Cloud deployments are particularly at risk if Langflow instances have access to metadata services (AWS IMDSv1, GCP metadata) or internal Kubernetes APIs. Attackers can extract API keys, database connection strings, cloud provider credentials, and architectural information. Even in single-tenant deployments, the ability to pivot from a flow-author account to internal services reduces defense-in-depth and can enable lateral movement into backend systems, databases, or monitoring infrastructure.

Affected systems

IBM Langflow OSS versions 1.0.0 through 1.9.3 are vulnerable. This includes all releases prior to the vendor's patch. Organizations should identify Langflow instances in development, testing, and production environments and verify their version against the official IBM/Langflow release notes to confirm patch availability and applicable version ranges.

Exploitability

Exploitation requires authentication and the flow author role, making it a low-barrier attack for insider threats or accounts obtained via credential compromise. No special network access or complexity is needed; an attacker simply configures a flow with a public redirect chain. The attack is deterministic—follow_redirects is a documented API parameter—and likely easily discoverable through documentation review or interface exploration. There is no user interaction requirement.

Remediation

Upgrade IBM Langflow OSS to a patched version released after CVE-2026-10129 disclosure. Verify against the official IBM/Langflow security advisory and release notes for the exact fixed version number. As an interim control pending patching, disable or restrict the follow_redirects parameter in the API Request component via configuration, code review of existing flows, or role-based access controls limiting flow-author privileges to trusted users only. Additionally, restrict Langflow network egress using firewall rules and network segmentation to block outbound connections to private IP ranges and cloud metadata endpoints (169.254.169.0/16, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Patch guidance

Monitor the official IBM Langflow GitHub repository and security advisories for a patched version. The fix should re-validate all redirect destinations against the same SSRF policy applied to the initial URL. When a patch becomes available, test it in a non-production environment to ensure no functional regression before deploying to production. Document the patching date and version for compliance and audit purposes. If a patch is not yet available, prioritize the interim mitigations listed above.

Detection guidance

Monitor API Request component logs and flow execution events for unusual follow_redirects usage, especially with public URLs as sources. Look for flows authored or modified by low-privileged users that include API Request steps. Examine network egress from Langflow instances for connections to 127.0.0.1, private IP ranges, or cloud metadata endpoints (169.254.169.254). Review flow definitions in version control or the application's flow store for suspicious redirect chains. Correlate timestamp of flow creation or modification with authentication logs for the flow author account.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (8.5), the broad scope of impact (internal systems, cloud metadata, cross-system compromise potential), and the low barrier to exploitation (authentication + author role). Langflow's use in multi-tenant and cloud-native architectures amplifies risk. While not yet in the KEV catalog, the combination of insider threat potential and sensitive data exposure justifies urgent patching and interim controls.

Risk score, explained

The CVSS 3.1 score of 8.5 reflects: attack vector network (N), low attack complexity (L), low required privileges (L), no user interaction (N), and changed scope (C) because the attacker can reach systems beyond the application itself. The impact includes high confidentiality loss (C:H) through credential and data disclosure and low integrity impact (I:L) from potential manipulation of internal services. Availability is not impacted (A:N). The changed scope elevates severity because an authenticated low-privilege user can affect internal systems and other tenants or applications relying on those internal services.

Frequently asked questions