CVE-2026-105741: Langflow X-Forwarded-For spoof lets

CISO Take

Langflow versions 1.5.0 up to 1.10.3 trust the X-Forwarded-For header on the MCP project install endpoint, so any authenticated user can pass the 'local-only' check by sending 127.0.0.1 and write or overwrite an MCP client configuration file on the server. The CVSS of 7.1 is driven by integrity impact, but because the file controls which MCP servers and commands an agent environment trusts, it can become a stepping stone to code execution or persistent tampering. Near-term exploitation risk is modest: EPSS is 0.00212 (top 89th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template, though Langflow is a frequent target (191 other CVEs in this package) and has been linked to an LLM-driven extortion operation reported in AIID #1578, which involved a different, unconfirmed-as-related flaw. Upgrade to Langflow 1.10.3 or later, and until then restrict Langflow account creation, keep it off the public internet, and make sure any reverse proxy strips or overwrites client-supplied X-Forwarded-For headers.

Sources:NVDGitHub AdvisoryEPSSATLASlangflow-ai/langflow GitHub (release v1.10.3, PR #13915)AI Incident Database

What is the risk?

Medium-high. Exploitation is trivial once authenticated (a single HTTP request with a forged header, low complexity, no user interaction), but it needs a valid low-privilege account, which limits exposure on properly gated instances. Impact is high integrity (arbitrary write/overwrite of an MCP config file) and low availability (a clobbered config can break MCP clients). Exposure is highest for multi-user or internet-facing Langflow instances, and for deployments where signup is open or accounts are shared. No KEV listing, no public exploit and low EPSS (0.00212) suggest low immediate exploitation pressure, but the Langflow attack surface is heavily targeted, so patch promptly.

How does the attack unfold?

Initial Access

Attacker authenticates to Langflow with a low-privilege account or stolen API key.

AML.T0012

Exploitation

Attacker sends a POST to the MCP install endpoint with X-Forwarded-For: 127.0.0.1 to bypass the local-only restriction.

AML.T0049

Persistence

The server writes or overwrites an MCP client configuration file with attacker-controlled content.

AML.T0081

Impact

Agent clients load the tampered config, connecting to malicious MCP servers or commands, risking tool hijacking and follow-on code execution.

AML.T0053

Initial Access

Attacker authenticates to Langflow with a low-privilege account or stolen API key.

AML.T0012

Exploitation

Attacker sends a POST to the MCP install endpoint with X-Forwarded-For: 127.0.0.1 to bypass the local-only restriction.

AML.T0049

Persistence

The server writes or overwrites an MCP client configuration file with attacker-controlled content.

AML.T0081

Impact

Agent clients load the tampered config, connecting to malicious MCP servers or commands, risking tool hijacking and follow-on code execution.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	>= 1.5.0, < 1.10.3	`1.10.3`
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ALow

What should I do?

1 step

1) Upgrade langflow to 1.10.3 or later (pip install -U 'langflow>=1.10.3'). 2) Until patched, block or restrict POST /api/v1/mcp/project/*/install at the reverse proxy/WAF to trusted admin sources. 3) Configure the front proxy to strip or overwrite inbound X-Forwarded-For and only trust known proxy IPs. 4) Disable open registration, review Langflow user accounts and API keys, and remove unneeded access. 5) Do not expose Langflow directly to the internet; place it behind VPN or SSO. 6) Detection: search access logs for requests to /api/v1/mcp/project/*/install containing X-Forwarded-For 127.0.0.1 or other loopback values from non-local sources; monitor and baseline MCP client config files (file integrity monitoring) for unexpected changes; audit MCP server entries for unfamiliar commands or URLs. 7) If tampering is suspected, restore configs from known-good, rotate credentials and tokens referenced by MCP configs.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassSupply ChainFrameworkAgentPluginAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.4.4-Tooling resources

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-105741?

Langflow versions 1.5.0 up to 1.10.3 trust the X-Forwarded-For header on the MCP project install endpoint, so any authenticated user can pass the 'local-only' check by sending 127.0.0.1 and write or overwrite an MCP client configuration file on the server. The CVSS of 7.1 is driven by integrity impact, but because the file controls which MCP servers and commands an agent environment trusts, it can become a stepping stone to code execution or persistent tampering. Near-term exploitation risk is modest: EPSS is 0.00212 (top 89th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template, though Langflow is a frequent target (191 other CVEs in this package) and has been linked to an LLM-driven extortion operation reported in AIID #1578, which involved a different, unconfirmed-as-related flaw. Upgrade to Langflow 1.10.3 or later, and until then restrict Langflow account creation, keep it off the public internet, and make sure any reverse proxy strips or overwrites client-supplied X-Forwarded-For headers.

Is CVE-2026-105741 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-105741, increasing the risk of exploitation.

How to fix CVE-2026-105741?

1) Upgrade langflow to 1.10.3 or later (pip install -U 'langflow>=1.10.3'). 2) Until patched, block or restrict POST /api/v1/mcp/project/*/install at the reverse proxy/WAF to trusted admin sources. 3) Configure the front proxy to strip or overwrite inbound X-Forwarded-For and only trust known proxy IPs. 4) Disable open registration, review Langflow user accounts and API keys, and remove unneeded access. 5) Do not expose Langflow directly to the internet; place it behind VPN or SSO. 6) Detection: search access logs for requests to /api/v1/mcp/project/*/install containing X-Forwarded-For 127.0.0.1 or other loopback values from non-local sources; monitor and baseline MCP client config files (file integrity monitoring) for unexpected changes; audit MCP server entries for unfamiliar commands or URLs. 7) If tampering is suspected, restore configs from known-good, rotate credentials and tokens referenced by MCP configs.

What systems are affected by CVE-2026-105741?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM orchestration/workflow builders, MCP-integrated agent deployments, Multi-user AI development platforms.

What is the CVSS score for CVE-2026-105741?

CVE-2026-105741 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM orchestration/workflow buildersMCP-integrated agent deploymentsMulti-user AI development platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.4.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account (open signup, phished or reused credentials, or a leaked API key). They send POST /api/v1/mcp/project/{project_id}/install with the header X-Forwarded-For: 127.0.0.1, so the server treats the request as local and accepts it. The request writes a crafted MCP client configuration that points to an attacker-controlled MCP server or a malicious command. When the MCP client or agent on that host next loads the config, it connects to or launches the attacker's tooling, giving the attacker influence over agent tool calls and a path to code execution or data access in the AI environment.

Weaknesses (CWE)

CWE-290Authentication Bypass by SpoofingPrimary CWE-290Authentication Bypass by SpoofingPrimary CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-345Insufficient Verification of Data AuthenticityPrimary CWE-290Authentication Bypass by Spoofing CWE-345Insufficient Verification of Data Authenticity

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.