CVE-2026-10129: IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in th
highvulnerability
security
Summary
IBM Langflow OSS versions 1.0.0 through 1.9.3 have a vulnerability where attackers can bypass SSRF protection (a security feature that prevents the server from making requests to internal systems). An authenticated user with basic permissions can enable a follow_redirects setting and use a public URL that redirects to internal addresses, allowing them to access sensitive internal services and data that should be blocked.
Vulnerability Details
CVSS Score
8.5(high)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack Vector
network
Attack Complexity
low
Privileges Required
low
User Interaction
none
Disclosure Date
June 30, 2026
Classification
Attack Type
Supply Chain
Attack SophisticationModerate
Impact (CIA+S)
confidentialityintegrity
Taxonomy References
Affected Vendors
LangChain
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-10129
First tracked: June 30, 2026 at 08:09 PM
Classified by LLM (prompt v3) · confidence: 92%