IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server‑Side Request Forgery. The legacy RSSReaderComponent in rss.py and the SearXNG component in searxng.py send unvalidated HTTP requests to URLs supplied by users. This bypasses the SSRF protections that were added in version 1.9.3. An attacker who is authenticated to the system can use this flaw to reach internal endpoints, including cloud metadata services such as those in AWS, Azure, and GCP, which may expose IAM credentials or other secrets. The flaw can also be triggered through prompt injection in agentic workflows where tool_mode=True is enabled, expanding the attack surface.

Affected systems are IBM Langflow OSS, versions 1.0.0 through 1.9.6. The specific components at risk are the RSSReaderComponent and the SearXNG component. No other vendors or products are listed as affected by this issue.

The CVSS base score of 8.2 places this vulnerability in the high severity range, and because the EPSS score is not available, the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated user leveraging the RSSReaderComponent or SearXNG component, or an attacker exploiting prompt injection to trigger the components indirectly. Once the SSRF payload is sent, internal resources can be discovered and potentially exfiltrated, enabling further lateral movement or privilege escalation.