CVE-2026-81265

Executive Summary

CVE-2026-81265 is a server-side request forgery (SSRF) vulnerability (CWE-918) affecting IBM Langflow OSS versions 1.0.0 through 1.11.5. The CVSS v3.1 base score is 7.5 (High), reflecting a network-reachable flaw with low attack complexity, no authentication or user interaction requirements, and a high confidentiality impact. Successful exploitation allows an unauthenticated remote attacker to coerce the vulnerable Langflow server into making requests to arbitrary destinations, potentially exposing internal-only services, cloud metadata endpoints, or sensitive data reachable from the application host. No public proof-of-concept, Nuclei template, or exploit code is currently available, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The vulnerability is classified under CWE-918 (Server-Side Request Forgery, SSRF). SSRF flaws occur when an application accepts a URL or network identifier from an untrusted source and then fetches that resource without adequate validation of the destination. Based on the NVD description — which is minimal ("IBM Langflow OSS 1.0.0 through 1.11.5") — the precise trigger point (specific endpoint, parameter, or component) is not disclosed in the available intelligence. This report therefore confines its analysis to the vulnerability class and does not assert specific function names, API paths, or parameters that are not documented in the supplied data.

Langflow is an open-source, low-code visual framework for building and deploying AI/LLM-powered applications and agent workflows. By their nature, Langflow deployments frequently: (1) make outbound HTTP requests to LLM providers, vector databases, and external APIs; (2) are exposed as web applications, often on default ports; and (3) run in containerized or cloud-hosted environments where an SSRF can be leveraged to reach the cloud instance metadata service (e.g., the 169.254.169.254 link-local address on major cloud providers) or internal microservices. These characteristics make SSRF a high-value vulnerability class in this product context.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates:

• AV:N (Network) — exploitable remotely over the network.
• AC:L (Low) — no special conditions or race windows required.
• PR:N (None) — no authentication or privileges needed.
• UI:N (None) — no victim user interaction required.
• S:U (Unchanged) — the impact is scoped to the vulnerable component's security authority.
• C:H (High) — significant confidentiality loss, consistent with an SSRF that can read internal responses.
• I:N / A:N — no direct integrity or availability impact asserted.

The combination of C:H with no authentication requirement is consistent with an attack that causes the server to query internal or privileged resources and return the response contents to the attacker. The absence of integrity and availability impact subscores suggests the flaw is used primarily for information disclosure (e.g., reading internal service responses, cloud metadata, or configuration) rather than for data modification or denial of service.

Because Langflow is used to orchestrate AI/agent workflows, an SSRF here can be particularly sensitive: the application may hold API keys, database credentials, model provider tokens, and internal service URLs that become reachable from the SSRF pivot point.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-81265; the following attack chain is inferred at the vulnerability-class level from the SSRF (CWE-918) classification and the CVSS subscores. No specific endpoints, functions, or parameters are asserted, because none are documented in the available NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-reachable Langflow OSS instance in versions 1.0.0–1.11.5. Discovery could occur via Shodan/Censys searches for Langflow-branded web interfaces or default deployment ports. Because the vulnerability requires no authentication (PR:N), no credential harvesting step is necessary.

2. Triggering the flaw class. The attacker supplies a crafted URL or network destination to a server-side request functionality that does not adequately validate or restrict the destination. In an SSRF of this class, the application accepts the attacker-controlled destination and initiates a request on the attacker's behalf. (The exact input surface — request parameter, body field, or feature — is not disclosed in the provided intelligence.)

3. Payload / execution at the class level. The attacker chooses destinations that are normally unreachable from outside the trust boundary, such as:

   • Cloud instance metadata endpoints (e.g., the 169.254.169.254 link-local address) to retrieve instance credentials or configuration.
   • Internal HTTP services, admin panels, or microservice APIs.
   • Localhost-bound services on the Langflow host itself. The attacker observes the response returned by the application to extract data about the internal resource.

4. Post-exploitation impact. Because the CVSS confidentiality subscore is High and integrity/availability are None, the expected outcome is information disclosure. In cloud environments, harvested metadata credentials can be a stepping stone to broader cloud account compromise. In AI/LLM deployments, disclosed secrets (provider API keys, internal DB URLs, tokens) can enable lateral movement or model/agent hijacking. The unchanged scope (S:U) indicates the direct security impact is bounded to the vulnerable Langflow component and its accessible resources.

Impact Assessment

• Confidentiality: High (C:H). The primary impact is unauthorized disclosure of data reachable by the Langflow server, including internal services and cloud metadata.
• Integrity / Availability: None asserted (I:N, A:N). Direct modification or disruption is not the stated impact.
• Attack prerequisites: None beyond network reachability (PR:N, UI:N, AC:L), meaning any exposed Langflow OSS 1.0.0–1.11.5 instance is a candidate target.
• Business impact: Langflow commonly sits in AI/ML pipelines holding API keys, database connection strings, and internal endpoint references. An SSRF can leak these secrets, exposing downstream LLM providers, vector stores, and internal networks. Where cloud metadata is reachable, the blast radius can extend to cloud IAM roles and account resources — a classic SSRF-to-cloud-takeover escalation path.
• Affected systems: Self-hosted and cloud-hosted IBM Langflow OSS deployments, versions 1.0.0 through 1.11.5. Organizations that expose Langflow to untrusted networks are highest-risk.
• Blast radius: Initially bounded to resources reachable from the Langflow host (internal network segment, metadata service). The practical blast radius is determined by the network position of the deployment and the secrets it holds.

Detection Guidance

Because the precise request signature is undocumented, the following rules are heuristic/tripwire detections targeting SSRF-class behavior in a Langflow context. They should be tuned to the deployment and validated before production use.

Sigma Rule

title: Potential SSRF Exploitation Attempt Against IBM Langflow (CVE-2026-81265)
id: 8f3c1a92-7b4e-4d61-9c2a-langflowssrf01
status: experimental
description: Detects requests to Langflow endpoints containing URLs pointing to internal,
  loopback, or cloud metadata addresses, consistent with SSRF (CWE-918).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81265
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_path:
    cs-uri-query|contains:
      - 'langflow'
  selection_payload:
    cs-uri-query|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - '127.0.0.1'
      - 'localhost'
      - '0.0.0.0'
      - '::1'
      - 'file://'
      - 'gopher://'
      - 'dict://'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate administrative testing of local resources
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_81265_Langflow_SSRF
{
    meta:
        description = "Detects SSRF-class indicators targeting IBM Langflow OSS (CVE-2026-81265)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81265"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lf1 = "langflow" nocase
        $ssrf1 = "169.254.169.254" ascii
        $ssrf2 = "metadata.google.internal" ascii nocase
        $ssrf3 = "http://127.0.0.1" ascii nocase
        $ssrf4 = "http://localhost" ascii nocase
        $ssrf5 = "gopher://" ascii nocase
        $ssrf6 = "dict://" ascii nocase
        $ssrf7 = "file:///" ascii nocase

    condition:
        $lf1 and any of ($ssrf*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81265 IBM Langflow SSRF Attempt - Internal/Metadata Target"; flow:established,to_server; http.uri; content:"langflow"; nocase; http.uri; content:"169.254.169.254"; nocase; sid:202681265; rev:1; reference:cve,2026-81265; classtype:attempted-recon; metadata:created_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-81265 IBM Langflow SSRF Attempt - Loopback Target"; flow:established,to_server; http.uri; content:"langflow"; nocase; http.uri; pcre:"/(127\.0\.0\.1|localhost|file:\/\/|gopher:\/\/|dict:\/\/)/i"; sid:202681266; rev:1; reference:cve,2026-81265; classtype:attempted-recon; metadata:created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      url.path : "*langflow*" ]
  [ network where network.protocol == "http" and
      ( url.query : "*169.254.169.254*" or
        url.query : "*metadata.google.internal*" or
        url.query : "*127.0.0.1*" or
        url.query : "*localhost*" or
        url.query : "*gopher://*" or
        url.query : "*dict://*" or
        url.query : "*file://*" ) ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=lower(coalesce(uri, url, cs_uri_query, request))
| where like(uri, "%langflow%")
| where (like(uri, "%169.254.169.254%") OR like(uri, "%metadata.google.internal%") OR
         like(uri, "%127.0.0.1%") OR like(uri, "%localhost%") OR
         like(uri, "%gopher://%") OR like(uri, "%dict://%") OR like(uri, "%file://%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as sample_uris by src_ip, dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,langflow,ssrf,">
  <rule id="2026812" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">langflow</field>
    <regex>169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|localhost|gopher://|dict://|file://</regex>
    <description>CVE-2026-81265: Possible SSRF exploitation attempt against IBM Langflow (internal/metadata target)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_81265,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source; no vendor fix or workaround is documented in the provided intelligence.

1. Immediate mitigations (compensating controls):

   • Remove Langflow OSS instances from direct internet exposure; place them behind an authenticated reverse proxy or VPN.
   • Restrict outbound network egress from the Langflow host using firewall/security-group rules; explicitly block access to cloud metadata addresses (e.g., 169.254.169.254) and internal RFC1918 ranges not required by the application.
   • Where metadata access is required, enforce IMDSv2-style protections (session-token requirements) on the hosting cloud platform to reduce SSRF-to-credential-harvest risk.
   • Apply WAF/network rules to flag or block requests containing internal/loopback/metadata destinations in parameters.

2. Patch / upgrade steps:

   • No vendor patch is currently available for versions 1.0.0–1.11.5. Monitor the IBM advisory channels and the Langflow project's release notes for a fixed version, and upgrade immediately once published.
   • Until a fix exists, treat all exposed instances as vulnerable and prioritize the compensating controls above.

3. Long-term hardening:

   • Adopt an allow-list approach for any server-side outbound request: validate and restrict destination hostnames, schemes, and IP ranges.
   • Enforce authentication and authorization on all Langflow endpoints and admin interfaces.
   • Segment AI/ML workloads into isolated network zones with least-privilege egress and no default access to metadata or management networks.
   • Rotate any secrets (LLM API keys, DB credentials, cloud tokens) that could have been exposed if exploitation is suspected.
   • Maintain asset inventory for Langflow deployments and subscribe to vendor and NVD advisories for CVE-2026-81265 updates.

References

1. NVD — CVE-2026-81265: https://nvd.nist.gov/vuln/detail/CVE-2026-81265
2. CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. IBM Security Bulletins (monitor for Langflow advisory): https://www.ibm.com/support/pages/security-bulletins
5. FIRST EPSS — not yet scored for CVE-2026-81265 (monitor: https://api.first.org/data/v1/epss?cve=CVE-2026-81265)

Threat actor / exploit-in-the-wild status: No public PoC, Nuclei template, or exploit code is known. CVE-2026-81265 is not listed in CISA KEV. No known threat actor campaigns or in-the-wild exploitation evidence are documented at the time of writing. Given the unauthenticated, remote nature of the flaw and Langflow's presence in cloud AI deployments, it should be treated as a high-priority exposure if internet-facing instances are identified.