CVE-2026-10129

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.3

Description The API Request component contains a Server-Side Request Forgery (SSRF) protection bypass. An authenticated attacker with flow author privileges can bypass security controls by enabling the follow redirects parameter and providing a public URL that redirects to internal or localhost addresses. The issue occurs because the application validates the initial URL but fails to re-validate the destination of the redirect. This allows unauthorized access to internal HTTP services, localhost endpoints, cloud metadata services, and private network resources, potentially leading to the disclosure of sensitive information such as credentials, tokens, internal API responses, and administrative panel data.

Recommendations Update IBM Langflow OSS to a version later than 1.9.3. As a temporary mitigation, restrict the use of the follow redirects parameter in the API Request component.