CVE-2026-3341CWE-918

IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services

Medium · published June 11, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-11T14:47Z
EPSS history
Timeline
  • 11 JUN 14:47Z
    IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services
    cvelistv5