CVE-2026-105741highBroken access control2026-10-07

CVE-2026-105741: Langflow trusts a spoofed X-Forwarded-For header on its local-only MCP install endpoint, letting remote users write MCP config files, fixed in 1.10.3

Langflow 1.5.0 up to 1.10.3 decided whether a request to POST /api/v1/mcp/project/{project_id}/install came from localhost by reading the first X-Forwarded-For entry, which the client controls. An authenticated remote user could send X-Forwarded-For: 127.0.0.1 to pass the local-only check and write or overwrite an MCP client configuration file on the server. Upgrade to 1.10.3 or later.

01.

What it is

The get_client_ip helper returned the leftmost X-Forwarded-For value unconditionally, with no check that the request actually came through a trusted proxy.

That helper gates install_mcp_config, which is meant to be local-only because it writes an MCP client configuration file on the server's filesystem.

The vulnerable code was introduced in v1.5.0; GitHub lists versions from 1.5.0 up to (not including) 1.10.3 as affected.

02.

How to check

Run pip show langflow and see whether the version is at least 1.5.0 and below 1.10.3.
Check whether your Langflow server is reachable by users other than you.

03.

How to fix

Upgrade Langflow to 1.10.3 or later.
If you run behind a reverse proxy, have it overwrite (not append to) X-Forwarded-For with the real client address.

pip show langflow | grep -i ^version
pip install -U 'langflow>=1.10.3'

04.

Sources

More advisories for this tool