CVE-2026-10129

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the application validates only the initial URL but does not re-validate redirect destinations. This allows attackers to access internal HTTP services, localhost endpoints, cloud metadata services, and private network resources that should be unreachable when SSRF protection is enabled. Successful exploitation can lead to disclosure of sensitive information including credentials, tokens, internal API responses, and administrative panel data.

• CWE-918

• https://www.ibm.com/support/pages/node/7277561Vendor Advisory

Published

Jun 30, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10123A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Th…8.8
• CVE-2026-10124A vulnerability was determined in Shibby Tomato up to 1.28. …8.8
• CVE-2026-10125A vulnerability was identified in Edimax BR-6478AC 1.23. Aff…8.8
• CVE-2026-10126A security flaw has been discovered in Edimax BR-6478AC 1.23…8.8
• CVE-2026-10127A weakness has been identified in Edimax BR-6478AC 1.23. Thi…6.3
• CVE-2026-10128IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated u…6.5
• CVE-2026-10130QueryWeaver contains an authentication bypass vulnerability …8.8
• CVE-2026-10134IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to r…10
• CVE-2026-1014IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …6.5
• CVE-2026-10140IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains im…9.6
• CVE-2026-10142kafka-python prior to 2.3.2 contains a denial-of-service vul…8.7
• CVE-2026-10143kafka-python prior to 2.3.2 contains a denial-of-service vul…8.7