CVE-2026-12767 identifies a server-side request forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5. SSRF vulnerabilities allow attackers to abuse the server to send crafted requests, potentially accessing internal resources or services not directly reachable by the attacker. This vulnerability is exploitable without authentication and has a medium severity rating (CVSS 3.1 score 6.5). No vendor advisory or patch information is currently available, so the remediation status is unknown.

An unauthenticated attacker can exploit this SSRF vulnerability to send unauthorized requests from the vulnerable system. This may enable network enumeration or facilitate further attacks by leveraging internal network access through the compromised server. The impact includes limited confidentiality and integrity loss but no direct availability impact is noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting outbound requests from the affected system or implementing network-level controls to limit SSRF exploitation.