Description

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:50.860Z",
  "pubdate": "2026-09-04T15:17:50.860Z",
  "executiveSummary": "A critical security vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.11.2, stemming from improper validation of network origin headers. The flaw allows remote authenticated attackers to bypass security controls designed to restrict Model Context Protocol (MCP) configuration management to localhost-only access. By spoofing the X-Forwarded-For HTTP header to 127.0.0.1, an attacker can trick the application into permitting unauthorized operations.\nThe vulnerability effectively leads to unauthorized arbitrary write access to critical IDE and system configuration files, such as ~/.cursor/mcp.json. This exposes the host system to significant risk, as attackers can inject malicious configurations, alter environment variables, or redirect execution contexts. Successful exploitation requires the attacker to be authenticated to the Langflow instance; however, once inside, the attacker can leverage the trust relationship between the application and the local filesystem to achieve persistent unauthorized access. The impact is severe, potentially leading to full compromise of the user's development environment.",
  "technicalDetails": "The root cause of this vulnerability lies in a flawed trust boundary implementation within the Langflow OSS middleware responsible for handling administrative or system-level configuration requests. The application relies on the X-Forwarded-For (XFF) HTTP header to determine the originating IP address of incoming requests to enforce a 'localhost-only' access control policy for MCP configuration management.\nBecause the application fails to adequately sanitize or validate the XFF header against untrusted proxies or direct client manipulation, it is susceptible to header spoofing. An attacker can craft an HTTP request containing the 'X-Forwarded-For: 127.0.0.1' header. When this request reaches the Langflow backend, the application incorrectly perceives the source as the local machine, thereby bypassing intended origin-based security checks.\nThe attack flow proceeds as follows: First, the remote authenticated attacker identifies the specific API endpoints responsible for updating or writing MCP configuration files. Second, the attacker issues a specially crafted request to these endpoints, injecting the spoofed XFF header. Third, the backend, lacking robust checks to ensure the header is populated by a trusted proxy or validated via socket-level origin verification, processes the request as if it originated from the loopback interface. Finally, the application executes write operations on sensitive files such as ~/.cursor/mcp.json.\nThis vulnerability is particularly impactful because the MCP mechanism often interfaces with IDEs and development tools. By gaining write access to these configuration files, an attacker can perform arbitrary file writes, potentially enabling Remote Code Execution (RCE) by modifying tool definitions, commands, or environment paths that the IDE or related development tools load upon execution. The vulnerability affects all Langflow OSS installations within the specified version range (1.0.0 - 1.11.2) that have enabled MCP features. The attack requires initial authentication to the Langflow interface, but does not require additional elevated system privileges beyond those granted by the process context in which the Langflow service is running. This effectively circumvents the security-by-isolation model intended for localized configuration management."
}