CVE-2026-9186: Langflow header spoof bypasses MCP

CISO Take

IBM Langflow's localhost-only safeguard for installing MCP server configurations can be defeated by an authenticated attacker simply spoofing the X-Forwarded-For: 127.0.0.1 header, allowing arbitrary writes to developer IDE config files such as ~/.cursor/mcp.json. This matters because Langflow sits at the center of many organizations' agentic AI pipelines, and the flaw turns a low-privilege application account into a write primitive against the developer's local tooling trust boundary — a foothold that can persist well beyond the Langflow session itself. There is no CISA KEV listing, no public exploit code, and no Nuclei template for this CVE, and EPSS data is unavailable, so opportunistic mass exploitation is unlikely today, but the CVSS 3.1 score of 6.5 (integrity-only impact) understates the downstream risk given that a poisoned MCP entry can silently register an attacker-controlled tool that executes when the developer's AI agent or IDE next loads it. Any organization running Langflow OSS below 1.11.2 that also uses MCP-integrated IDEs (Cursor and similar) should treat this as a supply-chain-adjacent config-injection risk, not a routine access-control bug. Upgrade to the patched Langflow release, audit existing MCP config files for unexpected entries, and restrict which authenticated Langflow roles can trigger MCP installation.

Sources:NVDibm.comATLAS

What is the risk?

Medium severity per CVSS (6.5, integrity-only impact, no confidentiality or availability loss), but the practical risk is elevated by context: the flaw requires only low privileges (PR:L) and no user interaction, and the bypass technique (spoofing a trust-boundary header) is trivial to execute once an attacker has any authenticated foothold in a Langflow instance. Exploitability is currently unconfirmed in the wild — not in CISA KEV, no public PoC or scanner template identified, and EPSS is not scored — so this reads as a plausible-but-not-yet-weaponized issue. The real elevated risk is architectural: the write target is IDE-level MCP configuration, meaning a successful exploit plants a foothold in developer tooling that can be leveraged well past the original Langflow session, converting a contained app-layer bug into a developer-workstation compromise vector.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege authenticated account on a Langflow instance.

AML.T0012

Access Control Bypass

Attacker sends a request to the MCP config installation endpoint with a spoofed X-Forwarded-For: 127.0.0.1 header to defeat the localhost-only restriction.

AML.T0049

Config Poisoning

Langflow writes an attacker-controlled MCP server entry into the victim's IDE config file (e.g., ~/.cursor/mcp.json).

AML.T0081

Agent Tool Compromise

The developer's IDE loads the poisoned MCP config, and their AI agent trusts and invokes the attacker's malicious MCP server as a legitimate tool.

AML.T0110

Initial Access

Attacker obtains a low-privilege authenticated account on a Langflow instance.

AML.T0012

Access Control Bypass

Attacker sends a request to the MCP config installation endpoint with a spoofed X-Forwarded-For: 127.0.0.1 header to defeat the localhost-only restriction.

AML.T0049

Config Poisoning

Langflow writes an attacker-controlled MCP server entry into the victim's IDE config file (e.g., ~/.cursor/mcp.json).

AML.T0081

Agent Tool Compromise

The developer's IDE loads the poisoned MCP config, and their AI agent trusts and invokes the attacker's malicious MCP server as a legitimate tool.

AML.T0110

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 3d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

Upgrade IBM Langflow OSS to the fixed release beyond 1.11.2 as soon as it is available/confirmed via the IBM advisory (support.ibm.com node 7285646). Until patched, do not place Langflow behind a proxy that forwards client-supplied X-Forwarded-For headers unmodified to the application, or strip/normalize that header at the edge (e.g., Caddy/nginx should set X-Forwarded-For itself rather than trust inbound values). Restrict which authenticated Langflow accounts have permission to install or modify MCP server configurations, and treat MCP config installation as a privileged action requiring elevated roles. As a detection measure, monitor and diff ~/.cursor/mcp.json and equivalent MCP config files on developer machines connected to Langflow for unexpected new entries, and alert on Langflow API requests that set X-Forwarded-For to loopback addresses (127.0.0.1) from external clients.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionSupply ChainAgentFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0081- Modify AI Agent Configuration AML.T0110- AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6-Third-party and supplier relationships

OWASP LLM Top 10

LLM03-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-9186?

IBM Langflow's localhost-only safeguard for installing MCP server configurations can be defeated by an authenticated attacker simply spoofing the X-Forwarded-For: 127.0.0.1 header, allowing arbitrary writes to developer IDE config files such as ~/.cursor/mcp.json. This matters because Langflow sits at the center of many organizations' agentic AI pipelines, and the flaw turns a low-privilege application account into a write primitive against the developer's local tooling trust boundary — a foothold that can persist well beyond the Langflow session itself. There is no CISA KEV listing, no public exploit code, and no Nuclei template for this CVE, and EPSS data is unavailable, so opportunistic mass exploitation is unlikely today, but the CVSS 3.1 score of 6.5 (integrity-only impact) understates the downstream risk given that a poisoned MCP entry can silently register an attacker-controlled tool that executes when the developer's AI agent or IDE next loads it. Any organization running Langflow OSS below 1.11.2 that also uses MCP-integrated IDEs (Cursor and similar) should treat this as a supply-chain-adjacent config-injection risk, not a routine access-control bug. Upgrade to the patched Langflow release, audit existing MCP config files for unexpected entries, and restrict which authenticated Langflow roles can trigger MCP installation.

Is CVE-2026-9186 actively exploited?

No confirmed active exploitation of CVE-2026-9186 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9186?

Upgrade IBM Langflow OSS to the fixed release beyond 1.11.2 as soon as it is available/confirmed via the IBM advisory (support.ibm.com node 7285646). Until patched, do not place Langflow behind a proxy that forwards client-supplied X-Forwarded-For headers unmodified to the application, or strip/normalize that header at the edge (e.g., Caddy/nginx should set X-Forwarded-For itself rather than trust inbound values). Restrict which authenticated Langflow accounts have permission to install or modify MCP server configurations, and treat MCP config installation as a privileged action requiring elevated roles. As a detection measure, monitor and diff ~/.cursor/mcp.json and equivalent MCP config files on developer machines connected to Langflow for unexpected new entries, and alert on Langflow API requests that set X-Forwarded-For to loopback addresses (127.0.0.1) from external clients.

What systems are affected by CVE-2026-9186?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, developer/IDE-connected AI tooling.

What is the CVSS score for CVE-2026-9186?

CVE-2026-9186 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationsdeveloper/IDE-connected AI tooling

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0081Modify AI Agent Configuration

AML.T0110AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).

Exploitation Scenario

An attacker who has obtained any low-privilege authenticated account on a shared or multi-tenant Langflow instance (e.g., via a leaked API key, weak credential, or an intentionally low-trust guest role) sends a request to the MCP configuration installation endpoint with the header X-Forwarded-For: 127.0.0.1. Langflow's access check trusts this header as proof the request originates from localhost and permits an operation normally restricted to the local operator, writing an attacker-supplied MCP server entry into the target developer's ~/.cursor/mcp.json (or equivalent IDE config path). The next time that developer opens their IDE, the AI coding agent loads the poisoned MCP configuration and connects to the attacker's MCP server as a trusted tool, giving the attacker a channel to feed malicious tool responses, exfiltrate data the agent has access to, or trigger further code execution on the developer's workstation.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.