CVE-2026-7754
published 2026-07-17CVE-2026-7754: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.34%
26.9th percentile
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | langflow_oss | 1.0.0 – 1.10.0 | — |
| langflow | langflow | >= 1.0.0 < 1.10.1 | 1.10.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Langflow OSS up to 1.10.0 SSRF Protection server-side request forgery
vuldb·2026-07-17·CVSS 7.7
CVE-2026-7754 [HIGH] IBM Langflow OSS up to 1.10.0 SSRF Protection server-side request forgery
A vulnerability categorized as critical has been discovered in IBM Langflow OSS up to 1.10.0. Affected by this issue is some unknown functionality of the component SSRF Protection. Executing a manipulation can lead to server-side request forgery.
This vulnerability is handled as CVE-2026-7754. The attack can be executed remotely. There is not any exploit available.
GHSA
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.
ghsa_unreviewed·2026-07-17
CVE-2026-7754 [HIGH] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-17
Published