Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
IBM · Langflow OSS