Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.3%
exploitation probability
0.3%top 78% of all CVEs
observed exploitation
nono source reports it
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
IBM · Langflow OSS