fkie_cve-2026-105741

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

GHSA-4f6c-2vvp-gw82 — Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Affected: PyPI: langflow

**Description**: ### Summary An IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (`POST /api/v1/mcp/project/{project_id}/install`) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed `X-Forwarded-For: 127.0.0.1` header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem.

### Details The vulnerability lived in the `get_client_ip` helper, used to enforce the local-only gate for `install_mcp_config`. It trusted the leftmost (fully client-controlled) entry of `X-Forwarded-For` unconditionally, with no check for whether the request had actually passed through a trusted proxy.

**Vulnerable code (introduced by commit `d3d06be8e5`, first released in v1.5.0):** `src/backend/base/langflow/api/v1/mcp_projects.py`

```python def get_client_ip(request: Request) -> str: # Check for X-Forwarded-For header (common when behind proxies) forwarded_for = request.headers.get("X-Forwarded-For") if forwarded_for: # The client IP is the first one in the list return forwarded_for.split(",")[0].strip() if request.client: return request.client.host return "255.255.255.255"

@router.post("/{project_id}/install") async def install_mcp_config( project_id: UUID, body: MCPInstallRequest, # {client: str, transport: "sse" | "s…

Most recent entries from all

fkie_cve-2026-105741

GHSA-4f6c-2vvp-gw82 — Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write