CVE-2026-3341 describes a server-side request forgery (SSRF) vulnerability in IBM Langflow Desktop versions 1.0.0 through 1.9.2. An authenticated attacker can exploit this flaw to cause the system to send unauthorized requests, potentially enabling network reconnaissance or facilitating further attacks. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity) with low complexity and requiring low privileges but no user interaction. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An authenticated attacker may leverage this SSRF vulnerability to make the affected system send unauthorized requests, which could lead to network enumeration or assist in other attack vectors. The confidentiality and integrity impacts are low, and there is no impact on availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions and monitor for suspicious activity related to internal request forwarding. Avoid exposing the affected versions in untrusted environments.