CVE-2026-7754 describes an SSRF vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0, including 1.9.0. The issue arises from insecure default configurations and incomplete enforcement of SSRF protection mechanisms, allowing an attacker with low privileges to induce the server to make unauthorized network requests. The vulnerability is rated with a CVSS 3.1 base score of 7.7 (high severity), indicating network attack vector, low attack complexity, low privileges required, no user interaction, and a confidentiality impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker with limited privileges to cause the affected server to send unauthorized requests to internal or external systems, potentially exposing sensitive information. The impact is limited to confidentiality loss; integrity and availability are not affected according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and harden SSRF protection configurations and restrict network access from the affected service where possible. Monitor vendor communications for updates on patches or official mitigations.