CVE-2026-10564: IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss

IBM Langflow OSS versions 1.0.0 through 1.9.6 have a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in two components that make unvalidated HTTP requests to user-controlled URLs. An authenticated attacker can exploit this to access internal resources like cloud metadata services (systems that store sensitive configuration and credentials for AWS, Azure, or GCP) and potentially steal credentials or map internal networks, or trigger the attack through prompt injection (tricking an AI by hiding malicious instructions in its input) in agentic workflows.