CVE-2026-10546 is a Server-Side Request Forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.3. The issue exists in the URL component (src/lfx/src/lfx/components/data_source/url.py) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited using DNS rebinding techniques. This vulnerability allows an attacker with low privileges and no user interaction to cause the server to make unauthorized requests, potentially leading to high confidentiality impact and partial integrity impact. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this SSRF vulnerability can lead to unauthorized server-side requests, potentially exposing sensitive information (high confidentiality impact) and causing limited integrity loss. There is no reported impact on availability. The attack requires network access and has a high attack complexity with low privileges needed and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, monitor IBM's advisories for updates. Until a fix is released, consider restricting network access to the vulnerable component and applying network-level controls to mitigate potential SSRF exploitation.