CVE-2026-10546: IBM Langflow OSS SSRF via TOCTOU Race Condition

Technical summary

The vulnerability exists in src/lfx/src/lfx/components/data_source/url.py and stems from a Time-of-Check/Time-of-Use (TOCTOU) race condition in URL validation logic. When a user provides a URL, the application checks it against a blocklist or validation rules at one point in time, but the actual network request occurs later. An attacker can configure a DNS name to resolve to a safe IP during validation, then change it to an internal or restricted IP address before the request is made. This enables SSRF attacks against internal services, metadata endpoints, or cloud infrastructure without triggering standard URL filtering. The attack surface requires authenticated access, limiting but not eliminating practical risk.

Business impact

Exploitation could allow authenticated users to access internal systems, retrieve sensitive data from cloud metadata services (AWS, GCP, Azure), or pivot laterally within network infrastructure. The confidentiality impact is high; an attacker could exfiltrate configuration details, API credentials, or database connection strings exposed on internal endpoints. Integrity impact is lower but possible through SSRF to internal APIs that modify state. Availability is not directly impacted. For organizations using Langflow as part of data pipeline automation or business process orchestration, compromise of internal service access represents significant risk to data security and operational integrity.

Affected systems

IBM Langflow OSS versions 1.0.0 through 1.9.3 are affected. Organizations running Langflow for workflow automation, data processing, or integration scenarios with internal network access are at risk. The vulnerability requires authenticated user access, so it does not pose risk from unauthenticated external attackers. Risk is elevated in multi-tenant deployments or environments where Langflow instances have network access to sensitive internal systems.

Exploitability

Exploitation requires valid login credentials and knowledge of internal network topology or services to target. The TOCTOU window is narrow but reliably exploitable with careful timing and DNS rebinding techniques. The CVSS score of 7.1 (HIGH) reflects the combination of high confidentiality impact, required authentication, and complex attack complexity. This is not a trivial vulnerability but achievable for motivated insiders or external attackers who have obtained credentials. No public exploit code has been reported, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities list as of the latest update.

Remediation

Upgrade to Langflow OSS version 1.9.4 or later, which resolves the TOCTOU race condition and strengthens URL validation. Organizations unable to upgrade immediately should restrict Langflow instance network access to only required external systems, implement network segmentation to isolate Langflow from sensitive internal services, and audit user access logs for suspicious URL component usage or unexpected outbound connections.

Patch guidance

Apply the latest available patch for Langflow OSS. Verify the specific patched version number against the official IBM/Langflow release notes and security advisories. Test patches in a non-production environment first, as URL validation changes may affect legitimate workflow configurations. If internal workflows rely on accessing internal services via URL components, review and validate those workflows after patching to ensure they continue to function correctly.

Detection guidance

Monitor Langflow application logs for URL component usage, particularly requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254, 169.254.170.254). Watch for DNS resolution timing inconsistencies or rapid DNS rebinding patterns. Network monitoring should flag outbound connections from Langflow instances to unexpected internal or restricted services. Audit login events and user activity around URL component configuration for anomalies or privilege escalation patterns. Review Langflow audit logs if available for failed URL validations or repeated attempts to access blocked resources.

Why prioritize this

Prioritize patching based on environment sensitivity. Instances with network access to sensitive internal systems, cloud metadata endpoints, or databases should be patched immediately. Those in isolated environments or with restricted network access represent lower immediate risk but should still be updated within standard patch cycles. Verify whether your Langflow deployment has authenticated users who could exploit this and what internal systems they could reach.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: high confidentiality impact from potential exposure of internal data or credentials; low integrity impact since SSRF typically enables reading rather than modification; no availability impact; requirement for authenticated access (reducing attack surface); and high attack complexity due to the precise timing and DNS rebinding needed. The 'Complex' complexity rating and 'Low' privilege requirement balance each other, resulting in elevated but not critical severity.

Frequently asked questions