Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
New DNS rebinding vulnerability (CVE-2026-10546, June 23) in Langflow OSS creates an SSRF risk via a TOCTOU race condition. This impacts data confidentiality in transit. Patch now! #Cybersecurity #Anonymous #News
Post summary
A new DNS rebinding vulnerability [CVE‑2026‑10546] in Langflow OSS is disclosed, highlighting an SSRF risk via a TOCTOU race condition, and a patch is now available.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |