CVE-2026-12766 is a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.2. An authenticated attacker can exploit this vulnerability to cause the system to send unauthorized requests, potentially leading to network reconnaissance or facilitating further attacks. The vulnerability is classified under CWE-918 and has a CVSS 3.1 base score of 5.4, indicating medium severity. There is no information about available patches or vendor advisories specifying remediation status.

An authenticated attacker may leverage this SSRF vulnerability to send unauthorized requests from the vulnerable system. This can lead to network enumeration, potentially exposing internal network structure or services, and may facilitate additional attacks. The impact is limited to confidentiality and integrity with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the affected system to trusted users only and monitor for suspicious activity related to unauthorized request attempts.