AIKIDO-2026-306750

langflow is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)CVE-2026-3341 Published Yesterday

Medium Risk

This Affects:

langflow

1.0.0 - 1.9.2

Fixed in 1.9.3

Are you affected? Scan for Free

TL;DR

Langflow's SSRF protection validates a user-supplied URL by resolving its hostname with one DNS lookup, but the server-side HTTP client (httpx.AsyncClient) performs a separate DNS lookup when the request is actually sent. This time-of-check/time-of-use gap lets an attacker-controlled domain with a very low TTL rebind between the two lookups, returning a public IP during validation and a private address at request time. As a result the SSRF checks can be bypassed to reach localhost, internal networks, and cloud metadata endpoints such as 169.254.169.254, with the response body returned to the caller. The fix adds network-level DNS pinning so the validated IP is the exact address used for the request and enables SSRF protection by default.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and use the API Request / URL data source component with an attacker-influenced URL.