CVE-2026-12765 is a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.2. An unauthenticated attacker can exploit this flaw to cause the system to send unauthorized requests, potentially enabling network reconnaissance or facilitating further attacks. The vulnerability is classified under CWE-918 and has a CVSS 3.1 base score of 6.5, indicating medium severity. No vendor advisory or patch information is currently available.

An attacker without authentication can leverage this SSRF vulnerability to make the affected system send unauthorized requests. This may allow the attacker to enumerate internal network resources or assist in launching additional attacks. There is no indication of direct data compromise or denial of service from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected system and monitor for unusual outbound requests that could indicate exploitation attempts.