AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-18545

IBM Langflow OSS: server-side request forgery

IBM

CVE-2026-18545 · Published Aug 28, 2026 · updated Aug 31, 2026

Medium4.3
No fix yet
IBM advisory

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Affected versions

PackageAffectedFixed in
Langflow OSS
Product
>= 1.0.0, <= 1.11.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More IBM advisories

All IBM
Critical 9.1Aug 28IBM Concert: SQL injectionCVE-2026-3627no fix yetMedium 6.2Aug 28IBM Cloud Pak for Data System: denial of serviceCVE-2026-3686no fix yetHigh 7.5Aug 28IBM Langflow OSS: path traversalCVE-2026-18899no fix yetHigh 8.2Aug 28IBM Langflow OSS: information disclosureCVE-2026-18904no fix yetCritical 9.8Aug 28IBM Langflow OSS: remote code executionCVE-2026-19286no fix yetMedium 6.4Aug 28IBM Langflow OSS: improper authorizationCVE-2026-19294no fix yet