CVE-2026-7657 is a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. The vulnerability arises from incomplete and ineffective enforcement of SSRF protections, allowing an attacker with low privileges to induce the server to make unauthorized network requests. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low complexity, and no user interaction required. Confidentiality impact is high, while integrity and availability impacts are none. No official remediation or patch has been published by IBM as of the current data.

An attacker with low privileges could exploit this SSRF vulnerability to cause the server to make unauthorized requests, potentially leading to unauthorized access to internal resources or sensitive information disclosure. The confidentiality impact is rated high, but there is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access from the affected application and monitor for unusual outbound requests as a precaution.