CVE-2026-3340

IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7271096	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow_desktop:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) IBM Langflow Desktop 1.0.0 hasta 1.8.4 IBM Langflow es vulnerable a falsificación de petición del lado del servidor (SSRF). Esto podría permitir a un atacante autenticado enviar peticiones no autorizadas desde el sistema, lo que podría llevar a la enumeración de la red o facilitar otros ataques.

Information

Published : 2026-04-30 21:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-3340

Mitre link : CVE-2026-3340

CVE.ORG link : CVE-2026-3340

JSON object : View

Products Affected

langflow

langflow_desktop

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-3340", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3340", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T16:07:55.291225Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:langflow_desktop:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:langflow_desktop:1.8.4:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Langflow Desktop", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.8.4"}]}]}], "published": "2026-04-30T21:16:32.463", "references": [{"url": "https://www.ibm.com/support/pages/node/7271096", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks."}, {"lang": "es", "value": "IBM Langflow Desktop 1.0.0 hasta 1.8.4 IBM Langflow es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). Esto podr\u00eda permitir a un atacante autenticado enviar peticiones no autorizadas desde el sistema, lo que podr\u00eda llevar a la enumeraci\u00f3n de la red o facilitar otros ataques."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83CB6A3F-0146-4A7A-9FDF-7F49CCBBC143", "versionEndIncluding": "1.8.4", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}