Parser Mismatch Bug Exposes IBM Langflow and CrewAI to Internal Network Attacks

A security researcher has discovered a Server-Side Request Forgery (SSRF) vulnerability affecting IBM's Langflow and CrewAI, two widely used AI agent frameworks, tracked as CVE-2026-19304 and a pending CVE respectively. The flaw stems from a parser disagreement: Python's urlparse and the urllib3 HTTP library interpret the same crafted URL differently, allowing a single backslash character in the URL authority section to bypass security guards. While the SSRF validation layer sees a safe public IP address, the underlying HTTP client actually connects to a private or localhost address, granting attackers access to internal infrastructure. In AI agent frameworks, which are designed to fetch arbitrary URLs as a core function, this effectively removes the only barrier between user-supplied input and sensitive internal services such as cloud metadata endpoints, databases, and admin panels. The researcher confirmed the bypass works consistently across Python versions 3.11 through 3.13, and notes the vulnerability pattern is common across Python-based SSRF guards that rely on urlparse for validation.