Summary

1. Protection disabled / warn-only. The SSRF guard (lfx/utils/ssrf protection.py, added in 1.7.0 by #10544) shipped with ssrf protection enabled = False, and its only caller, the API Request component, called validate url for ssrf(url, warn only=True). So even with protection turned on, blocked URLs were only logged.
2. Inconsistent coverage. Other components that take a user-supplied URL or base URL did not call the guard at all: RSS Reader, SearXNG, Web Search (fetching result / RSS URLs), Home Assistant, Glean Search and Docling Serve (remote).

Affected versions

Details

response = requests.get(self.rss url, timeout=self.timeout)

# TODO: In next major version (2.0), remove warn only=True to enforce blocking
validate url for ssrf(url, warn only=True)

• web search.py: the DuckDuckGo search request and the Google News RSS request, and news search.py:131. The host is hard-coded (html.duckduckgo.com / news.google.com) and user input only goes into quote plus-encoded path and query segments, so the destination cannot be redirected. The real Web Search sink was fetching the result URLs, which is fixed in #14071.
• langflow/load/utils.py get flow(): this is a client-side SDK helper (from langflow.load import get flow) that the caller runs against their own Langflow URL. No API route calls it, so it is not a backend SSRF endpoint.

PoC (vulnerable versions)

1. Log in as any user who can create flows.
2. Add an RSS Reader (or SearXNG / Home Assistant / Glean / Docling Serve) component and set its URL to http://169.254.169.254/latest/meta-data/ (or an internal host such as http://10.0.0.1/).
3. Run the component. The Langflow server issues the request, and the response or error is shown in the component output.

Impact

• Access to cloud instance metadata (IAM credentials / tokens) on AWS, GCP and Azure deployments.
• Probing and interaction with internal services and private networks reachable from the Langflow host.
• Requires an authenticated account with permission to build or run flows. Deployments where every user is already fully trusted are less affected.

Fix

• #13016: sets ssrf protection enabled = True by default, changes warn only to default False, drops warn only=True from API Request, and adds validate and resolve url() plus SSRFProtectedTransport (DNS pinning).

-  ssrf protection enabled: bool = False
+  ssrf protection enabled: bool = True

• #13395: adds lfx.utils.ssrf requests.ssrf safe get (per-hop validation and pinning for requests) and uses it in RSS Reader and SearXNG.

-      response = requests.get(self.rss url, timeout=self.timeout)
+      response = ssrf safe get(self.rss url, timeout=self.timeout)

• #13643: adds lfx.utils.ssrf httpx (ssrf safe httpx get/post, protected client kwargs) and applies it to Home Assistant, Glean and the model-provider base-URL components.
• #14033: Docling Serve builds its httpx.Client with ssrf protected httpx client kwargs for url(base url).
• #14071 (release-1.10.3) / #14073 (forward-port to 1.11.0): Web Search validates and pins each result URL before fetching it, with redirects disabled.

Remediation

• Upgrade to langflow >= 1.10.3 (or langflow-base >= 0.10.3 / lfx >= 1.10.3 / lfx-docling >= 0.1.2).
• Do not set LANGFLOW SSRF PROTECTION ENABLED=false. If you need to reach internal hosts on purpose, allowlist only those hosts with LANGFLOW SSRF ALLOWED HOSTS.
• On versions that cannot be upgraded right away, restrict outbound network access from the Langflow host (for example, block 169.254.169.254 and use IMDSv2 on AWS).