CVE-2026-3340 is a server-side request forgery (SSRF) vulnerability in IBM Langflow Desktop versions 1.0.0 through 1.8.4. An authenticated attacker can exploit this flaw to cause the application to send unauthorized requests from the system, potentially enabling network reconnaissance or facilitating further attacks. The vulnerability is classified under CWE-918 and has a CVSS 3.1 score of 6.5 (medium severity). No vendor-provided patch or remediation details are currently available, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker with authentication can leverage this SSRF vulnerability to make the vulnerable system send unauthorized requests. This may allow the attacker to enumerate internal network resources or assist in other attack vectors. The impact is limited to confidentiality and integrity with no direct availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor IBM's advisories for updates. Until a patch is available, restricting access to the affected application and limiting authenticated user privileges may reduce risk.