IBM Langflow Desktop SSRF via DNS Rebinding Bypass (CVE-2026-3341)

IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services Vulnerability Overview CVEID: CVE-2026-3341 Description: IBM Langflow contains a Server-Side Request Forgery (SSRF) vulnerability. Attackers can exploit this vulnerability to send unauthorized requests, potentially leading to network enumeration or other attacks. CWE: CWE-918: Server-Side Request Forgery (SSRF) CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Affected Products Affected Product: IBM Langflow Desktop 1.0.0 - 1.9.2 Remediation Recommendation: IBM strongly recommends addressing this vulnerability immediately by upgrading to Langflow Desktop version 1.9.3. References Complete CVSS v3 Guide On-line Calculator v3 Related Information IBM Security Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry standard developed by the Forum of Incident Response and Security Teams (FIRST) intended to convey vulnerability severity and help determine response urgency and priorities. IBM provides the CVSS score "as is," without any express or implied warranties, including implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM regularly updates component records for components included in its product portfolio. As part of this effort, if IBM discovers previously unrecognized vulnerabilities affecting items in the product/service listing, IBM will update the vulnerability record, regardless of the date. The inclusion of an older CVEID does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability at that date. We are working to make customers aware of relevant vulnerabilities as we become aware of them. The "Affected Products and Versions" listed are intended to include only supported and non-end-of-life IBM products and versions. Therefore, the omission of unsupported or end-of-life products and versions from this security advisory does not constitute a determination by IBM that they are unaffected by the vulnerability. A reference to one or more unsupported versions in this security advisory does not impose an obligation on IBM to fix any unsupported or end-of-life products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Langflow Desktop SSRF via DNS Rebinding Bypass (CVE-2026-3341)