CVE-2026-10564 is a high-severity SSRF vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.9.6. The legacy RSSReaderComponent and SearXNG component make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. This allows an authenticated attacker to access internal resources, including cloud metadata services (AWS, Azure, GCP IMDS), potentially exfiltrating IAM credentials and enumerating internal networks. Additionally, the vulnerability can be exploited through prompt injection in agentic workflows due to exposure of tool_mode=True. The product is cloud-hosted, and IBM manages remediation for this service.

An authenticated attacker can exploit this SSRF vulnerability to access internal resources that are normally inaccessible externally. This includes cloud metadata services from major cloud providers, which may lead to exfiltration of sensitive IAM credentials and internal network reconnaissance. The vulnerability impacts confidentiality and partially integrity but does not affect availability. There are no known exploits in the wild at this time.

IBM Langflow OSS is a cloud-hosted service, and IBM manages remediation server-side. A patch is available that addresses this SSRF vulnerability by enforcing proper validation of HTTP requests and disabling legacy components that bypass protections. Users should verify with IBM's official advisory for confirmation of patch deployment and ensure their environments are updated accordingly. No additional user action is required if the service is fully managed and updated by IBM.