CVE-2026-19304: Bypassing SSRF Guards with Parser Confusion

IBM's Langflow and CrewAI have discovered a security vulnerability that allows attackers to bypass safeguards designed to prevent Server-Side Request Forgery (SSRF) attacks. The issue stems from a mismatch between how Python's urlparse and requests libraries interpret certain URL characters. To exploit the flaw, an attacker crafts a specially crafted URL containing a backslash character.

The SSRF guard, which checks the hostname of the URL, identifies the malicious IP address (e.g., 1.1.1.1) as legitimate. However, the HTTP client library, requests, actually establishes a connection to the attacker's localhost (127.0.0.1:8080). This discrepancy enables the attacker to access internal network resources, such as databases or admin panels, even if they only have limited permissions.

The vulnerability affects both Langflow (CVE-2026-19304) and CrewAI. Langflow and CrewAI utilize Python's urllib.parse module to parse URLs and check for blocked hostnames. However, the requests library parses the same URL string using urllib3, which treats the backslash character differently. As a result, the guard sees the URL as safe, while the client connects to an internal IP address and executes unauthorized actions.

The flaw impacts AI agent frameworks that are built to fetch arbitrary URLs, increasing the attack surface significantly. The vulnerability has been addressed in Langflow version 1.11.3 and CrewAI 1.15.17 by rejecting backslashes in the URL authority section. To prevent SSRF attacks, developers should consider blocking ambiguous characters or implementing stricter URL validation methods.