CVE-2026-10546

Published: Jun 30, 2026Modified: Jul 2, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.2 / Impact: 4.2

Source: NVD

Description

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.

Affected (1)

Products: Langflow: Langflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Langflow Langflow	From 1.0.0 to 1.9.3

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://www.ibm.com/support/pages/node/7277560

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.