CVE-2026-7657 - Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Back Back to CVE browser

MEDIUM

Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Published Aug 5, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.10.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Langflow OSS

n/a

Version	Status	Constraints
1.0.0	affected	<=1.10.3

Remediation

Vendor solution

IBM recommends upgrading to Langflow OSS 1.11.0 or newer https://github.com/langflow-ai/langflow/releases

Weaknesses (1)

CWE-918

SSRF

References (1)

https://www.ibm.com/support/pages/node/7282650
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7282650		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Aug 5, 2026

Updated Aug 5, 2026

Reserved May 1, 2026

Link CVE-2026-7657

CISA Vulnrichment

Updated Aug 5, 2026

NVD

Status Analyzed

Modified Aug 6, 2026

Link CVE-2026-7657

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-7657