An insecure default configuration in IBM Langflow OSS and an incomplete enforcement of the SSRF protection mechanism can let an attacker make the server fetch arbitrary URLs. The resulting SSRF can expose internal services, leak sensitive information, and potentially allow further compromise of network components. This flaw concerns the domain of outbound request destinations, as classified by CWE‑918.

The vulnerability affects IBM Langflow OSS versions 1.0.0 through 1.10.0, and also Langflow 1.9.0. The affected product is IBM’s Langflow OSS component, available as a Python package from the PyPI repository.

The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1% shows a very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the SSRF nature of the flaw, the likely attack vector is remote, via HTTP requests sent to endpoints that accept a user‑supplied URL and fail to perform proper validation. Exfiltration or reach to internal network resources would depend on the server’s network reachability.