Langflow component SSRF vulnerability fix
Start here
A Langflow security advisory notes that some built-in components that accept URLs previously lacked effective server-side request restrictions, and authenticated users with permission to create or run flows could potentially use this to access internal resources reachable by the server. Protection for the affected components was added in stages, and the fixes listed in the advisory were completed in Langflow 1.10.3; fix versions for different underlying software packages need to be checked separately.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- GitHub 安全公告SelectedLangflow fixes SSRF protection vulnerabilities that were disabled by default in multiple components
The Langflow security advisory states that some built-in components that receive URLs previously lacked effective server-side request restrictions. Authenticated users with permission to create or run flows could potentially use this to access internal resources reachable by the server. Protections for the affected components were rolled out in stages, and the fixes listed in the advisory were completed in Langflow 1.10.3; fix versions for different underlying software packages need to be checked separately.
Related discussion
Attention trend
New sources per day
- Oct 6: 1 new sources (1 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)