CVE-2026-3341 IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services

What is CVE-2026-3341?

CVE-2026-3341 is a medium-severity server-side request forgery vulnerability in IBM Langflow Desktop, published on 11 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Weakness: CWE-918

Which versions are affected by CVE-2026-3341?

It affects 1 product.

Products include Langflow Langflow Desktop.

How do I fix CVE-2026-3341?

No fix has been published for CVE-2026-3341 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-3341 being exploited?

There is no known exploitation of CVE-2026-3341 in the wild and no public exploit code.

Other vulnerabilities in IBM Langflow Desktop

• CVE-2026-6543 Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint High 8.8
• CVE-2026-4503 Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint High 7.5
• CVE-2026-3340 Server-Side Request Forgery (SSRF) in Langflow URL Component Medium 6.5
• CVE-2026-3345 Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint Medium 6.5
• CVE-2026-4502 Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wvfv-3qjh-qwxj.