CVE-2026-3341: IBM Langflow Desktop SSRF Vulnerability

Technical summary

CVE-2026-3341 is an SSRF vulnerability in Langflow Desktop's request handling logic. The flaw allows authenticated attackers to craft requests that the server processes on their behalf, potentially reaching internal resources, cloud metadata endpoints, or other services not normally accessible from the client. The vulnerability stems from insufficient validation or filtering of URLs supplied by authenticated users (CWE-918). With a CVSS 3.1 score of 5.4 (MEDIUM), the attack vector is network-based, requires valid credentials (PR:L), and causes limited confidentiality and integrity impact without availability disruption.

Business impact

This vulnerability poses operational risk primarily to organizations running Langflow Desktop in networked environments where internal services or cloud metadata APIs are accessible. Unauthorized network enumeration could expose architecture details, service locations, or credential metadata (AWS, GCP credentials). Secondary impacts depend on what internal services an attacker can reach—potential lateral movement, data exposure, or abuse of trusted services. The threat is limited to authenticated users, but organizations with shared or compromised credentials face elevated risk.

Affected systems

IBM Langflow Desktop versions 1.0.0 through 1.9.2 are vulnerable. The vulnerability does not affect later versions. Langflow Desktop is used by data teams, ML engineers, and developers building LLM workflows locally or in isolated environments. Organizations should inventory Langflow Desktop deployments and determine which instances run on versions within the affected range, particularly those connected to networks containing sensitive internal services.

Exploitability

Exploitation requires valid authentication credentials; an unauthenticated attacker cannot trigger the vulnerability. Exploitation is otherwise straightforward—an authenticated user simply needs to supply a crafted URL to trigger a request from the server. The attack complexity is low, and no special privileges or user interaction are required once authentication is established. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited evidence of active exploitation in the wild, though this does not guarantee attackers are unaware of or unable to exploit it.

Remediation

Upgrade IBM Langflow Desktop to a version newer than 1.9.2. Verify the specific patched version by consulting IBM's security advisory. Until patching is possible, restrict network access from systems running vulnerable Langflow Desktop instances, disable access to internal metadata endpoints (AWS IMDSv1, etc.), and apply credential rotation if any accounts with Langflow Desktop access are suspected compromised. Monitor for unusual outbound network requests from Langflow processes.

Patch guidance

IBM has released fixes for this vulnerability in versions after 1.9.2. Consult IBM's official security advisory or the Langflow project repository for the exact patched version number and release date. Most users should upgrade to the latest stable release of Langflow Desktop. For production or air-gapped environments, test patches in a staging environment first. If you are running version 1.9.2 or earlier, prioritize upgrade planning.

Detection guidance

Monitor network traffic originating from Langflow Desktop processes for unexpected outbound connections, especially to internal IP ranges, cloud metadata services (169.254.169.254), or non-standard ports. Review Langflow Desktop logs and HTTP request logs for evidence of SSRF-like request patterns (requests to localhost, private IP ranges, or cloud metadata endpoints). Correlate authentication logs with suspicious outbound network activity to identify potentially compromised accounts attempting exploitation. SIEM rules detecting requests to internal services from desktop applications can help surface abuse.

Why prioritize this

While the CVSS score of 5.4 is moderate, prioritization should account for environmental factors: organizations with Langflow Desktop instances connected to networks housing sensitive internal services or cloud metadata endpoints should patch urgently. The authentication requirement reduces the risk surface but does not eliminate it in environments where credentials are shared, reused, or frequently compromised. Early adoption in ML/DevOps teams and close proximity to cloud infrastructure increases practical risk for many organizations.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible vulnerability with low attack complexity and low privileges required, balanced against limited scope (single user context) and modest confidentiality and integrity impact. The score appropriately captures the technical severity but may underweight organizational risk for companies whose Langflow Desktop deployments sit on networks with exposed internal services or cloud credentials. Consider a higher internal severity rating if your environment meets those conditions.

Frequently asked questions