CyberRota Analysis
AI-GeneratedIBM Langflow OSS versions 1.0.0 through 1.10.3 are vulnerable to a Server-Side Request Forgery (SSRF) due to inadequate validation of the user-supplied OLLAMA_BASE_URL parameter in the validate_model_provider_key() function. This flaw allows attackers to craft requests that can access internal services or sensitive data, potentially leading to unauthorized access and data exposure. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).
Related CVEs
Other vulnerabilities affecting the same vendor(s)