Description
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.
References6
- github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f…
- github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e2…
- github.com/langflow-ai/langflow/pull/13915
- github.com/langflow-ai/langflow/releases/tag/v1.10.3
- github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2…
- github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2…
Metrics
- CVSS 3.1
-
7.1
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - EPSS — exploit probability
- 0% percentile: 16 · as of 10 November 2026
- CWE
- CWE-290CWE-345
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.