CVE-2026-10129

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the application validates only the initial URL but does not re-validate redirect destinations. This allows attackers to access internal HTTP services, localhost endpoints, cloud metadata services, and private network resources that should be unreachable when SSRF protection is enabled. Successful exploitation can lead to disclosure of sensitive information including credentials, tokens, internal API responses, and administrative panel data.

• CWE-918

• https://www.ibm.com/support/pages/node/7277561Vendor Advisory

Published

Jun 30, 2026

Last Modified

Oct 25, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10128IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated u…6.5
• CVE-2026-101280A vulnerability was detected in Trusted Domain Project OpenD…7.3
• CVE-2026-101281A flaw has been found in Trusted Domain Project OpenDMARC up…7.3
• CVE-2026-101283iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer ov…9.2
• CVE-2026-101287Authentication bypass vulnerability in Stela, versions prior…9.3
• CVE-2026-101288IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote a…8.8
• CVE-2026-101290A remote attacker may send a specially crafted network packe…7.5
• CVE-2026-101292Apache ActiveMQ Artemis before 2.34.0 contains an unsafe ref…8.2
• CVE-2026-101294IBM WebSphere Application Server - Liberty 17.0.0.3 through …8.7
• CVE-2026-101295Path traversal / arbitrary file write in oc-mirror's operato…7.3
• CVE-2026-101296A missing critical step in authentication vulnerability in A…8.1
• CVE-2026-10130QueryWeaver contains an authentication bypass vulnerability …8.2