### Summary Before **Langflow 1.10.3**, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example `http://169.254.169.254/latest/meta-data/`), and in many cases read the response back through the component output. Two things combined to cause this: 1. **Protection disabled / warn-only.** The SSRF guard (`lfx/utils/ssrf_protection.py`, added in 1.7.0 by #10544) shipped with `ssrf_protection_enabled = False`, and its only caller, the **API Request** component, called `validate_url_for_ssrf(url, warn_only=True)`. So even with protection turned on, blocked URLs were only logged. 2. **Inconsistent coverage.** Other components that take a user-supplied URL or base URL did not call the guard at all: RSS Reader, SearXNG, Web Search (fetching result / RSS URLs), Home Assistant, Glean Search and Docling Serve (remote). The problem was fixed across several PRs and is fully fixed in **Langflow 1.10.3** (and 1.11.0+). With the default settings, outbound requests from these components are now validated after DNS resolution, pinned to the validated IP (to prevent DNS rebinding) and **blocked** when they target private, loopback, link-local or metadata addresses, unless the operator allowlists the host. ### Affected versions | Package (PyPI) | Vulnerable | Patched | |---|---|---| | `langflow` | `< 1.10.3` | `1.10.3` | | `langflow-base` | `< 0.10.3` | `0.10.3` | | `lfx` | `< 1.10.3` | `1.10.3` | | `lfx-docling` (Docling Serve component) | `< 0.1.2` | `0.1.2` | How the fix rolled out: | Release | Change | |---|---| | `< 1.7.0` | No SSRF guard. All URL-taking components make unrestricted requests. | | `1.7.0` – `1.9.2` | Guard exists, but `ssrf_protection_enabled=False` by default and API Request uses `warn_only=True`. | | `1.9.3` | #13016: protection **on by default**, API Request **blocks** (DNS pinning / anti-rebinding). Other components still unprotected. | | `1.10.1` | #13395 (RSS Reader, SearXNG) and #13643 (Home Assistant, Glean, plus model-provider URL components) route requests through SSRF-safe helpers. | | `1.10.3` | #14033 (Docling Serve) and #14071 (Web Search result/RSS fetching). **All components cited in this report are protected.** | ### Details Vulnerable pattern (for example `rss.py` before #13395): ```python response = requests.get(self.rss_url, timeout=self.timeout) ``` API Request before #13016: ```python # TODO: In next major version (2.0), remove warn_only=True to enforce blocking validate_url_for_ssrf(url, warn_only=True) ``` with `ssrf_protection_enabled: bool = False` in the settings. **Clarifications on the original report.** Some sinks in the report are not exploitable SSRF: - `web_search.py`: the DuckDuckGo search request and the Google News RSS request, and `news_search.py:131`. The host is hard-coded (`html.duckduckgo.com` / `news.google.com`) and user input only goes into `quote_plus`-encoded path and query segments, so the destination cannot be redirected. The real Web Search sink was fetching the **result URLs**, which is fixed in #14071. - `langflow/load/utils.py` `get_flow()`: this is a client-side SDK helper (`from langflow.load import get_flow`) that the caller runs against their own Langflow URL. No API route calls it, so it is not a backend SSRF endpoint. ### PoC (vulnerable versions) 1. Log in as any user who can create flows. 2. Add an **RSS Reader** (or SearXNG / Home Assistant / Glean / Docling Serve) component and set its URL to `http://169.254.169.254/latest/meta-data/` (or an internal host such as `http://10.0.0.1/`). 3. Run the component. The Langflow server issues the request, and the response or error is shown in the component output. On patched versions the same run fails with `SSRFProtectionError: Access to IP address 169.254.169.254 is blocked by SSRF protection`. ### Impact - Access to cloud instance metadata (IAM credentials / tokens) on AWS, GCP and Azure deployments. - Probing and interaction with internal services and private networks reachable from the Langflow host. - Requires an authenticated account with permission to build or run flows. Deployments where every user is already fully trusted are less affected. ### Fix - **#13016**: sets `ssrf_protection_enabled = True` by default, changes `warn_only` to default `False`, drops `warn_only=True` from API Request, and adds `validate_and_resolve_url()` plus `SSRFProtectedTransport` (DNS pinning). ```diff - ssrf_protection_enabled: bool = False + ssrf_protection_enabled: bool = True ``` - **#13395**: adds `lfx.utils.ssrf_requests.ssrf_safe_get` (per-hop validation and pinning for `requests`) and uses it in RSS Reader and SearXNG. ```diff - response = requests.get(self.rss_url, timeout=self.timeout) + response = ssrf_safe_get(self.rss_url, timeout=self.timeout) ``` - **#13643**: adds `lfx.utils.ssrf_httpx` (`ssrf_safe_httpx_get/post`, protected client kwargs) and applies it to Home Assistant, Glean and the model-provider base-URL components. - **#14033**: Docling Serve builds its `httpx.Client` with `ssrf_protected_httpx_client_kwargs_for_url(base_url)`. - **#14071** (release-1.10.3) / **#14073** (forward-port to 1.11.0): Web Search validates and pins each result URL before fetching it, with redirects disabled. Note: connector-style components (for example Home Assistant, Ollama, LM Studio) keep a documented loopback exemption (#14146), so a self-hosted user can reach a local service on `localhost`. Private-network and metadata addresses stay blocked. Operators can tighten or relax this with `LANGFLOW_SSRF_ALLOWED_HOSTS` and `LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED`. ### Remediation - Upgrade to `langflow >= 1.10.3` (or `langflow-base >= 0.10.3` / `lfx >= 1.10.3` / `lfx-docling >= 0.1.2`). - Do not set `LANGFLOW_SSRF_PROTECTION_ENABLED=false`. If you need to reach internal hosts on purpose, allowlist only those hosts with `LANGFLOW_SSRF_ALLOWED_HOSTS`. - On versions that cannot be upgraded right away, restrict outbound network access from the Langflow host (for example, block `169.254.169.254` and use IMDSv2 on AWS).
PoC: CVE-2026-98260
6.12.69-android16-6-g242e1a07f878
PoC: CVE-2026-112706-CoreMedia-fd-leak
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
PoC: php2shell-scanner
Scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
PoC: CVE-2026-112611-cg-shading
CVE-2026-112611/112610: CoreGraphics PDF out-of-bounds writes (fixed in iOS 27.2) — fix-diff analysis, on-device proof, methodology, and PoC generator scripts. No prebuilt PoCs, no crash reports.
PoC: php2shell-lab
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
PoC: PHP2SHELL-Checker-v-2.0-CVE-2026-115560-
Versión 2.0 — añade barrido de hosts remotos vía HTTP a la v1.0. Cuando se ejecuta sin argumentos muestra un menú interactivo.
PoC: ghostlock-tv
adb-to-root kernel LPE (GhostLock CVE-2026-43499) for the onn 4K Pro Google TV: futex PI UAF to write primitive to credential swap to uid 0, on locked verified-boot hardware
PoC: CVE-2026-71195
Offline Python detector for CVE-2026-71195 exposure in OpenStack Manila, with branch-aware rules, CSV/JSON inventories, and auditable reports.
PoC: CVE-2026-94300
Offline Python detector for CVE-2026-94300 exposure in ISC BIND 9, with edition-aware rules, CSV/JSON inventories, and auditable reports.
PoC: CVE-2023-7356
Offline Python detector for CVE-2023-7356 exposure in upstream Linux kernels, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-113870
Offline Python detector for CVE-2026-113870 exposure in MongoDB Compass inventories, with CSV/JSON input and auditable reports.
PoC: CVE-2026-89035
Offline Python detector for CVE-2026-89035 exposure in MikroTik RouterOS inventories, with CSV/JSON input and auditable reports.
PoC: CVE-2026-76475
Offline Python detector for CVE-2026-76475 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
PoC: CVE-2026-76474
Offline Python detector for CVE-2026-76474 exposure in Cisco UC inventories, with CSV/JSON input, versioned rules, and auditable reports.
PoC: CVE-2026-76473
Offline Python detector for CVE-2026-76473 release exposure in Cisco UC inventories, with CSV/JSON input and auditable reports.
PoC: CVE-2026-84636-PoC
Proof of concept of CVE-2026-84636, WiFi SSID Info Disclosure
PoC: CVE-2026-79397-Authenticated-OS-Command-Injection-in-ONT-4GE-RFDW-Ping-Diagnostics
Authenticated OS command injection in ONT-4GE-RFDW’s Ping diagnostics exploitable via default credentials.
PoC: rw-salon
CVE-2024-4442
PoC: rw-tutor
CVE-2024-4223
PoC: CVE-2026-111497-DOS-
CVE-2026-111497 DOS
PoC: rw-stock
CVE-2024-36779
PoC: php2shell-nse-scanner
Advanced Nmap Scripting Engine (NSE) script designed to identify PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Features multi-layer Black-Box analysis resilient against WAF, proxies, and header stripping.
PoC: rw-web-directory-free
CVE-2024-3552
PoC: cve-2025-27740
Proof-of-concept exploit for CVE-2025-27740 Subject Key Identifier injection in Active Directory Certificate Services
PoC: rw-country-state-city-auto-dropdown
cve-2024-3495
PoC: rw-fluentform
CVE-2024-2771
PoC: CVE-2023-42824
PoC / exploit archive for CVE-2023-42824
PoC: CVE-2024-4443
PoC / exploit archive for CVE-2024-4443
PoC: CVE-2024-7120
PoC / exploit archive for CVE-2024-7120
PoC: CVE-2024-8503
PoC / exploit archive for CVE-2024-8503
PoC: CVE-2025-24000
PoC / exploit archive for CVE-2025-24000
PoC: CVE-2025-30567
PoC / exploit archive for CVE-2025-30567
PoC: CVE-2025-54726
PoC / exploit archive for CVE-2025-54726
PoC: CVE-2025-58443
PoC / exploit archive for CVE-2025-58443
PoC: CVE-2026-19632
PoC / exploit archive for CVE-2026-19632
PoC: CVE-2026-31635
PoC / exploit archive for CVE-2026-31635
PoC: node2shell-status
Node2Shell / Broccoli2Shell (CVE-2026-111497) vendor and Linux distro status - AI-generated, verify before acting
PoC: PHP2shell
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
PoC: CVE-2026-116692
PoC / exploit archive for CVE-2026-116692
PoC: CVE-2026-114595
CVE-2026-114595
PoC: CVE-2026-86426
PoC / exploit archive for CVE-2026-86426
PoC: CVE-2026-98260-y700-TB321FU-lpe
CVE-2026-98260 adaptation for Lenovo Legion Y700 2025 (TB321FU) / 1.1.10.138 boot image, kernel 6.1.112-android14-11
PoC: CVE-2019-18935
PoC / exploit archive for CVE-2019-18935
PoC: cve-2026-43499-mt6896-pd2238
cve-2026-43499 exploit on vivo's MT6896 device PD2238.
PoC: trojan-source-check
CI scanner for Trojan Source attacks: bidi control characters (CVE-2021-42574), mixed-script identifiers (CVE-2021-42694), invisible zero-width chars. Stdlib only.
PoC: php2shell-cve-2026-109618-109619
calibrated php2shell payloads for common docker images
PoC: mlflow-scorer-scanner
Detection-only triage scanner for MLflow scorer RCE CVE-2026-116692: version check via the /version endpoint. No payloads, no scorer invocation.
PoC: cve-2026-98260-nezha
CVE-2026-98260: Xiaomi 17 Ultra (nezha) temporary root + KernelSU PoC - scripts, docs and logs only; exploit built from upstream source
PoC: work1-secure-api
HDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis
PoC: php80-scl-el7-rebuild
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between Remi -6 and -21, among them CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
PoC: Triagem-de-Explora-o-CVE-2024-49138-detectada
Triagem de Alerta SOC 335, que destaca a exploração da vulnerabilidade CVE-2024-49138 , uma vulnerabilidade de escalonamento de privilégios do Windows.
PoC: CVE-2026-42530
CVE-2026-42530 - NGINX HTTP/3 (QPACK) UAF
PoC: CVE-2026-1277
PoC / exploit archive for CVE-2026-1277
PoC: CVE-2026-105482-Reproduce
CVE-2026-105482漏洞复现
PoC: cve-gitea
CVE-2022-30781
PoC: shellshock-linux-host-hardening-lab
Controlled penetration testing and Linux host-hardening lab demonstrating Shellshock (CVE-2014-6271), privilege escalation, vulnerability assessment and defensive security controls.
PoC: php-scare-counted
Verification artifacts for 'How I replicated PHP2Shell, and 5 ways we got super lucky' — checkers for every claim: the fix that shipped nowhere, the four-architecture map, the two-gate leak bands, and the blind-fire arithmetic (CVE-2026-109618/109619)
PoC: CVE-2026-102785
PoC / exploit archive for CVE-2026-102785
PoC: php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testing only.
PoC: CVE-2026-5054
CVE-2026-5054: writeup + PoC
PoC: CVE-2026-5053
CVE-2026-5053: Writeup + PoC
PoC: brotli-pingback-lab
WordPress XML-RPC pingback lab and crash PoC for CVE-2026-111497 (Brotli decoder out-of-bounds write).
PoC: CVE-2026-48356
PoC / exploit archive for CVE-2026-48356
PoC: bkwld-decoy-cve-2026-116471
Security research and documentation for BKWLD Decoy 5.11.1 — CVE-2026-116471.
PoC: CVE-2026-40281
PoC / exploit archive for CVE-2026-40281
PoC: DotNet-HTTP2Shell-CVE-2026-111497
CVE-2026-111497 - .NET Brotli OOB Write PoC and Exploit (HTTP2Shell) | By Gh0st-Bx1
PoC: CVE-2026-102785
CVE-2026-102785: YOOtheme Pro 5.0.0-5.0.52 unauthenticated RCE via image handler signature reuse + path traversal + JPEG/PHP polyglot. CVSS 10.0. Check script, exploit, detection rules.
PoC: lg-webos2-root
Persistent root for LG webOS 2.x TVs (CVE-2014-3153)
PoC: brotli-k8s-scan
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers, so it catches bundled copies in Node.js, Python, .NET, Bun and Envoy. Read-only, bash only.
PoC: CVE-2026-97798-exploit
CVE-2026-97798 Windows Error Reporting - Command Injection TO SYSTEM
PoC: ehax-log4shell-openhouse
EHAX DTU Open House: safe, isolated Log4Shell (CVE-2021-44228) wallpaper-reveal demo with Minecraft 1.8.8
PoC: CVE-2026-101767
PoC / exploit archive for CVE-2026-101767
PoC: CVE-2026-114509
PoC / exploit archive for CVE-2026-114509
PoC: CVE-2026-109618-109619
PHP2Shell CVE-2026-109618 / CVE-2026-109619 Mitigation work (Ansible Role)
PoC: plex2scan
Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more)
PoC: CVE-2026-8467
PoC / exploit archive for CVE-2026-8467
PoC: brotli-check
Portable PHP Brotli decoder inventory for WordPress, Drupal and Symfony — CVE-2026-111497
PoC: TomcatRace-CVE-2024-50379
PoC and exploit for CVE-2024-50379 - Apache Tomcat Race Condition RCE (CVSS 9.8)
PoC: TomcatPartialPUT-CVE-2025-24813
PoC and exploit for CVE-2025-24813 - Apache Tomcat Partial PUT RCE (CVSS 9.8)
PoC: CVE-2026-98260
6.6.118-android15-8-g9bc34d5b0c79
PoC: hdu-is-lab1
Information Security Lab 1: secure REST API, CI security scans, and CVE-2024-1561 analysis
PoC: CVE-2026-117532-poc
PoC for CVE-2026-117532 in REDAXO Authentication bypass, full chain not yet implemented. CVSS score 9.3 critical
PoC: CVE-2026-16723-vul
CVE-2026-16723漏洞环境与poc
PoC: php2shell-cve-2026-109618
just an experiment
PoC: CVE-2026-96760
PoC / exploit archive for CVE-2026-96760
PoC: ConsulK8s-CVE-2026-110720
CVE-2026-110720 - HashiCorp consul-k8s Cross-Namespace ACL Bypass PoC & Exploit
PoC: AuthenticatorFlaw-CVE-2026-80097
CVE-2026-80097 - Microsoft Authenticator Android Token Theft PoC & Exploit
PoC: DotNet-Tarball-CVE-2026-114148
CVE-2026-114148 - .NET Linux Tarball Local Privilege Escalation PoC & Exploit
PoC: wasmtime-sweep
Find every Wasmtime engine embedded in binaries, wheels, NuGet packages and layers, and check CVE-2026-115889/115893
PoC: hdu-is-lab1-secure-api
HDU IS Lab 1: secure Flask REST API, CI/CD SAST+SCA pipeline and CVE-2021-43798 analysis
PoC: CVE-2024-47167
PoC / exploit archive for CVE-2024-47167
PoC: CVE-2026-1277
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
PoC: CVE-2026-1306
The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution
PoC: cve-2026-15176
CVE-2026-15176 — NGINX alias+rewrite heap overflow: analysis, differential lab, PoC (WIP)
PoC: CVE-2026-1296
Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious site
PoC: php2shell
Pre-auth RCE exploit toolkit — CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF)
PoC: node2shell-scanner
Scanner for php2shell (CVE-2026-111497)
PoC: php2shell-scanner
Scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
PoC: brotli2scan
Is your website affected by HTTP2Shell (CVE-2026-111497)?
PoC: php2shell
CVE-2026-109618 · CVE-2026-109619
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free