CVE-2026-12766 identifies a server-side request forgery vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.2. This vulnerability allows an authenticated attacker to cause the system to make unauthorized requests, potentially leading to network reconnaissance or facilitating further attacks. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No vendor advisory or patch information is available at this time.

An authenticated attacker can exploit this SSRF vulnerability to send unauthorized requests from the affected system. This may allow the attacker to enumerate internal networks or assist in launching additional attacks. Confidentiality and integrity impacts are possible, but availability is not affected. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions and monitor for suspicious activity related to SSRF attempts.