Read the docs
TI-2026-68352 Aliases CVE-2026-105741GHSA-4f6c-2vvp-gw82

IP spoofing in Langflow lets attackers write MCP client configuration

Priority MEDIUM 64CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

Langflow from 1.5.0 before 1.10.3 is affected. The Model Context Protocol (MCP) configuration installation endpoint trusts a spoofed X-Forwarded-For header to decide that a request comes from localhost, which bypasses its local-only restriction (CWE-290). An authenticated remote attacker can write or overwrite an MCP client configuration file on the server filesystem.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed langflow (langflow-ai): 1.10.3langflow (PyPI): 1.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Langflowlangflow1.5.0 to before 1.10.31.10.3Patch availableCNA
—langflow (PyPI)1.5.0 to before 1.10.31.10.3Patch availableGHSA-4f6c-2vvp-gw82
  • langflow VendorLangflow Affected 1.5.0 to before 1.10.3 Fixed in 1.10.3 Patch available CNA
  • langflow (PyPI) Vendor— Affected 1.5.0 to before 1.10.3 Fixed in 1.10.3 Patch available GHSA-4f6c-2vvp-gw82

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*——Langflow
  • cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* Versions — — ·Langflow

Remediation

Upgrade the PyPI package langflow to version 1.10.3, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA langflow (langflow-ai) Fixed in 1.10.3
  • Fix · GHSA-4f6c-2vvp-gw82 langflow (PyPI) Fixed in 1.10.3 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105741
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-07 Alias added: GHSA-4f6c-2vvp-gw82
  4. 2026-10-07 Fix available: PyPI/[email protected] · GHSA-4f6c-2vvp-gw82
  5. 2026-10-07 CVSS score added · GHSA-4f6c-2vvp-gw82
  6. 2026-10-07 Weakness changed · GHSA-4f6c-2vvp-gw82
  7. 2026-10-07 7 new references · GHSA-4f6c-2vvp-gw82

References

Advisory 1

Other 6

  • TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
  • TI-2025-24427 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE KEVCVSS 4.0CRITICAL 9.4
  • TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-25463 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4
See all 236 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences