CVE-2026-9077: Langflow MCP config write bypasses

CISO Take

IBM Langflow versions 1.0.0 through 1.10.3 fail to properly enforce a localhost-only restriction on an internal endpoint, letting a remote authenticated attacker write arbitrary MCP server configurations into IDE configuration files on the host running Langflow. This matters because Langflow is a widely deployed low-code framework for building LLM agent pipelines, and MCP server configs are trusted-by-default — an attacker who plants a malicious entry effectively pre-authorizes a rogue tool to execute with the developer's or service account's privileges the next time the IDE or agent loads. The exploitation bar is low (network access, low privileges, no user interaction, CVSS 8.5) but current telemetry shows no public exploit, no Nuclei template, absence from CISA KEV, and an EPSS score of just 0.3%, with CISA SSVC rating it TRACK rather than an urgent priority. Given the novelty of this MCP config-poisoning technique against agentic AI tooling, prioritize upgrading past 1.10.3 immediately, restrict Langflow's management interface to trusted networks with network-level controls (do not rely on the app's own localhost check), and audit MCP server entries in Claude Desktop/Cursor/VS Code config files on any host that ran an affected Langflow instance.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

High severity (CVSS 8.5) driven by an integrity-impacting, scope-changed vulnerability: an authenticated but otherwise low-privilege remote attacker can escape Langflow's intended trust boundary and modify security-relevant configuration files outside the application's own sandbox. Exploitability is straightforward technically (AC:L, no user interaction), but real-world exploitation likelihood is currently low — EPSS is 0.3%, there is no public PoC or scanner template, and it is not in CISA KEV, with SSVC assigning only a TRACK priority. The residual risk is elevated by the target: MCP server configuration files are inherently trusted by IDEs and agent runtimes, so a successful write is a durable persistence and privilege-escalation primitive rather than a one-off information disclosure.

How does the attack unfold?

Initial Access

Attacker with low-privilege authenticated access sends a crafted request to a Langflow endpoint that is supposed to be restricted to localhost callers.

AML.T0049

Exploitation

The flawed localhost-only check is bypassed, allowing the request to reach functionality that writes MCP server configuration data to IDE config files on the host.

AML.T0081

Persistence via Tool Poisoning

The attacker-controlled MCP server entry is loaded as a trusted tool the next time the IDE or agent runtime reads its configuration.

AML.T0110

Impact

When the poisoned MCP tool is invoked, attacker code executes with the developer's local privileges, enabling credential theft, source exfiltration, or lateral movement.

AML.T0112.000

Initial Access

Attacker with low-privilege authenticated access sends a crafted request to a Langflow endpoint that is supposed to be restricted to localhost callers.

AML.T0049

Exploitation

The flawed localhost-only check is bypassed, allowing the request to reach functionality that writes MCP server configuration data to IDE config files on the host.

AML.T0081

Persistence via Tool Poisoning

The attacker-controlled MCP server entry is loaded as a trusted tool the next time the IDE or agent runtime reads its configuration.

AML.T0110

Impact

When the poisoned MCP tool is invoked, attacker code executes with the developer's local privileges, enabling credential theft, source exfiltration, or lateral movement.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I High

A None

What should I do?

1 step

Upgrade Langflow to a version beyond 1.10.3 as soon as IBM/Langflow publishes a fix (track the vendor advisory at ibm.com/support/pages/node/7282147). Until patched, do not expose Langflow's management/API interface to any network beyond a tightly controlled admin segment, and enforce network-layer isolation (firewall/reverse proxy allowlisting) rather than trusting the application's own localhost-only check, since that check is exactly what this CVE bypasses. Audit MCP server configuration files (Claude Desktop config.json, Cursor settings, VS Code MCP config) on hosts that have run affected Langflow versions for unexpected or unauthorized entries, and rotate/revoke any credentials those hosts had access to. Detection: monitor for unexpected writes to IDE configuration file paths correlated with Langflow process activity, and alert on new/modified MCP server entries outside of change-managed deployments.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Supply Chain Code Execution Agent Framework Plugin AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

GOVERN-6.1 - Policies and procedures address AI risks associated with third-party components and supply chain

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-9077?

IBM Langflow versions 1.0.0 through 1.10.3 fail to properly enforce a localhost-only restriction on an internal endpoint, letting a remote authenticated attacker write arbitrary MCP server configurations into IDE configuration files on the host running Langflow. This matters because Langflow is a widely deployed low-code framework for building LLM agent pipelines, and MCP server configs are trusted-by-default — an attacker who plants a malicious entry effectively pre-authorizes a rogue tool to execute with the developer's or service account's privileges the next time the IDE or agent loads. The exploitation bar is low (network access, low privileges, no user interaction, CVSS 8.5) but current telemetry shows no public exploit, no Nuclei template, absence from CISA KEV, and an EPSS score of just 0.3%, with CISA SSVC rating it TRACK rather than an urgent priority. Given the novelty of this MCP config-poisoning technique against agentic AI tooling, prioritize upgrading past 1.10.3 immediately, restrict Langflow's management interface to trusted networks with network-level controls (do not rely on the app's own localhost check), and audit MCP server entries in Claude Desktop/Cursor/VS Code config files on any host that ran an affected Langflow instance.

Is CVE-2026-9077 actively exploited?

No confirmed active exploitation of CVE-2026-9077 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9077?

Upgrade Langflow to a version beyond 1.10.3 as soon as IBM/Langflow publishes a fix (track the vendor advisory at ibm.com/support/pages/node/7282147). Until patched, do not expose Langflow's management/API interface to any network beyond a tightly controlled admin segment, and enforce network-layer isolation (firewall/reverse proxy allowlisting) rather than trusting the application's own localhost-only check, since that check is exactly what this CVE bypasses. Audit MCP server configuration files (Claude Desktop config.json, Cursor settings, VS Code MCP config) on hosts that have run affected Langflow versions for unexpected or unauthorized entries, and rotate/revoke any credentials those hosts had access to. Detection: monitor for unexpected writes to IDE configuration file paths correlated with Langflow process activity, and alert on new/modified MCP server entries outside of change-managed deployments.

What systems are affected by CVE-2026-9077?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration platforms, MCP tool integrations, developer AI tooling environments.

What is the CVSS score for CVE-2026-9077?

CVE-2026-9077 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI orchestration platformsMCP tool integrationsdeveloper AI tooling environments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

Exploitation Scenario

An attacker who has obtained low-privilege authenticated access to a shared or exposed Langflow instance (e.g., via a leaked API key, weak credential, or insider access) sends a crafted request to the endpoint intended to be restricted to localhost callers. The flawed restriction check is bypassed, and the attacker's request causes Langflow to write an MCP server configuration entry — pointing to an attacker-controlled server binary or URL — into the IDE configuration file on the host. The next time a developer opens their IDE or an agent runtime reloads its MCP tool list, it silently registers the attacker's malicious MCP server as a trusted tool. When the agent or developer subsequently invokes that tool (directly or via automatic tool selection), the attacker's code executes with the developer's local privileges, enabling credential theft, source code exfiltration, or lateral movement into CI/CD and cloud environments.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision Primary CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.