CVE-2026-10564: IBM Langflow SSRF Vulnerability – Credential Theft via Cloud Metadata

Technical summary

The vulnerability stems from unvalidated HTTP request handling in rss.py (RSSReaderComponent) and searxng.py (SearXNG component) within Langflow OSS. Despite SSRF protections added in version 1.9.3, these legacy components bypass those defenses by directly requesting user-controlled or indirectly user-influenced URLs without proper validation. When tool_mode=True is enabled—common in agentic workflows—an attacker can inject malicious prompts that cause the application to fetch arbitrary URLs. This includes internal endpoints like 169.254.169.254 (cloud metadata services), which expose temporary security credentials and sensitive infrastructure details. The CVSS 3.1 score of 8.2 (HIGH) reflects high confidentiality impact and the ease of exploitation (network-accessible, no user interaction required, but requires authentication).

Business impact

Organizations running Langflow as part of their AI/automation infrastructure face credential theft and lateral movement risks. Stolen cloud IAM credentials could allow attackers to assume roles with production permissions, access databases, or pivot to other cloud services. Internal network enumeration could expose non-public services (databases, private APIs, monitoring systems) to further compromise. For companies using Langflow in customer-facing or agent-based applications, the prompt injection variant means end-user inputs become an attack surface, effectively lowering the barrier from 'authenticated attacker' to 'any user interacting with an agentic workflow.' The reputational and compliance impact (exposed secrets, data exfiltration) is significant.

Affected systems

IBM Langflow OSS versions 1.0.0 through 1.9.6 are vulnerable. Version 1.9.3 introduced partial SSRF protections, but the legacy RSSReaderComponent and SearXNG component were not updated to use them. Systems running versions after 1.9.3 but before a patched release remain at risk if these components are enabled. Self-hosted deployments and cloud-hosted instances (if user-controlled) are affected. Air-gapped or offline Langflow instances are not at risk from the network-based exploitation path.

Exploitability

The vulnerability requires authentication, which moderates (but does not eliminate) risk in environments where Langflow access is restricted. However, exploitability is otherwise straightforward: an authenticated user simply provides a malicious URL to RSSReaderComponent or SearXNG, or crafts a prompt that triggers tool invocation in an agentic workflow. No special tools, detailed system knowledge, or race conditions are required. Automated scanning of cloud metadata endpoints is well-established; attackers can reliably extract credentials. The prompt injection attack path is particularly insidious because it requires no direct URL manipulation—natural language suffices.

Remediation

Upgrade to a patched version of Langflow that applies SSRF protections uniformly across all HTTP-requesting components (verify against IBM's vendor advisory for the exact minimum safe version). If an immediate upgrade is not feasible, disable RSSReaderComponent and SearXNG if not needed, restrict Langflow to networks where internal metadata services and sensitive endpoints are not reachable, implement egress filtering to block requests to 169.254.169.254 and other cloud metadata ranges, and disable tool_mode in agentic workflows unless absolutely required. Additionally, audit IAM credentials and revoke any that may have been exposed.

Patch guidance

Check IBM's official Langflow release notes and security advisories for the patched version number (expected to be 1.9.7 or later based on the version range, but verify against the vendor advisory). Apply the patch at your earliest maintenance window; this is a HIGH-severity issue affecting authentication-gated access to cloud credentials. Test in a non-production environment first, particularly if you rely on RSSReaderComponent or SearXNG for core workflows—ensure the patch does not break legitimate use cases. After patching, audit outbound HTTP requests from Langflow to confirm no unexpected endpoints are being accessed.

Detection guidance

Monitor HTTP request logs from Langflow for connections to 169.254.169.254 (AWS IMDS), 168.63.129.16 (Azure IMDS), or 169.254.169.254:8775 (GCP metadata). Flag any requests from RSSReaderComponent or SearXNG to non-whitelisted internal IPs or private subnets. Review audit logs for authenticated users invoking these components with suspicious or external URLs. Implement a Web Application Firewall (WAF) or egress proxy rule blocking requests to cloud metadata CIDR ranges. In agentic deployments, log all tool invocations and the prompts that triggered them—look for patterns suggesting URL injection or metadata service probing.

Why prioritize this

This vulnerability warrants immediate attention due to the HIGH CVSS score, direct path to credential exfiltration, and the authentication bypass via prompt injection in agentic workflows. Organizations using Langflow in production should prioritize patching within 1–2 weeks. If RSSReaderComponent or SearXNG are not actively used, disabling them provides interim risk reduction while patches are tested.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: (1) network accessibility and lack of user interaction (high availability to attackers), (2) requirement for authentication (slightly lowers severity from 9.x to 8.x), (3) high confidentiality impact (credential theft, internal reconnaissance), and (4) low integrity and availability impact (the attacker reads data but does not modify or disrupt service). The prompt injection variant effectively reduces the authentication requirement's protective value in agentic contexts, making the real-world severity higher than the base CVSS score in those deployments.

Frequently asked questions