CVE-2026-10546: IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component (

IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making requests to unintended locations) in the URL component. The vulnerability is caused by a TOCTOU race condition (a timing bug where a system checks something at one moment but uses it at another, allowing attackers to change it in between), which attackers can exploit through DNS rebinding (a technique where an attacker changes what a domain name points to after the server checks it).