Langflow SSRF Vulnerability (CVE-2026-7754) Security Advisory

Vulnerability Overview Vulnerability Name: SSRF Protection Configuration Vulnerability CVE ID: CVE-2026-7754 Description: Langflow 1.9.0 contains a Server-Side Request Forgery (SSRF) vulnerability due to insecure default configurations and incomplete SSRF protection mechanisms. CVSS Score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Affected Products Affected Product: Langflow OSS Affected Versions: 1.0.0-1.10.0 Remediation Recommended Fix: Upgrade to Langflow OSS version 1.10.1 Temporary Mitigation: None Additional Information Publication Date: July 2, 2026 Document Number: 7278930 Operating Systems: Windows, Linux, Mac OS References Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer The Common Vulnerability Scoring System (CVSS), as defined by the Forum of Incident Response and Security Teams (FIRST), is an industry standard used to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" without any express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their environments. IBM regularly updates vulnerability records in its products; referencing an older CVE ID does not imply that the product was used by IBM or that IBM was aware of the vulnerability at the time it was disclosed. The referenced "Affected Products and Versions" refer only to products and versions supported and maintained by IBM. The omission of unsupported or extended-support products and versions does not constitute a decision by IBM regarding those products. The inclusion of one or more unsupported versions in this security advisory does not create an obligation for IBM to fix any unsupported or extended-support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

Langflow SSRF Vulnerability (CVE-2026-7754) Security Advisory

More from this source