CVE-2026-10564

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.6

Description An authenticated attacker can perform a Server-Side Request Forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. The issue exists because the RSSReaderComponent in rss.py and the SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing protections implemented in version 1.9.3. This can be exploited to access internal resources, such as cloud metadata services (AWS/Azure/GCP IMDS), allowing for the enumeration of internal networks and the exfiltration of IAM credentials. Additionally, the issue can be triggered via prompt injection in agentic workflows due to the exposure of the tool mode=True setting.

Recommendations Update IBM Langflow OSS to a version later than 1.9.6. As a temporary mitigation, restrict the use of the RSSReaderComponent and SearXNG components. Disable the tool mode=True setting in agentic workflows to prevent exploitation via prompt injection.