Langflow CVE-2026-6599

Exploitation requires PR:L (authenticated access) - the attacker must possess valid credentials to access the langflow instance and reach the Model Context Protocol Configuration API endpoints. The X-Forwarded-For header manipulation is the injection vector and requires no special client-side configuration beyond crafting an HTTP request with a malicious header value. Default langflow deployments are vulnerable if authentication is enabled but not sufficiently restricted; air-gapped or internally-deployed instances with limited user access are less exposed. The vulnerability is triggered when the install_mcp_config function processes MCP configuration requests that include user-controlled or forwarded client IP information.

CVSS 6.3 with vector AV:N/AC:L/PR:L indicates authenticated network-based access with low attack complexity and limited impact (confidentiality, integrity, availability). The presence of publicly available exploit code (POC=YES) combined with no KEV listing suggests real-world risk exists but exploitation appears targeted or still emerging rather than widespread automated campaigns. EPSS data is not provided, limiting probabilistic assessment. The E:P flag indicates exploit is probable, while RL:W (Workaround) and RC:R (Reasonable) suggest mitigations exist and confidence in reproducibility is moderate. The critical limitation is the PR:L (Privilege Level: Low) requirement - exploitation requires authenticated access to the langflow instance, significantly reducing attack surface compared to unauthenticated vulnerabilities. For organizations with public-facing langflow deployments or untrusted user populations, this poses material risk; for internal-only deployments with limited user access, risk is lower. The lack of vendor response to disclosure raises concern about patch timeline and availability.

An authenticated user with access to a langflow instance crafts an HTTP request to the Model Context Protocol Configuration API (install_mcp_config endpoint) with a malicious X-Forwarded-For header containing Python code injection payloads. The vulnerable get_client_ip function extracts and processes this header without sanitization, passing it downstream where it is evaluated in an unsafe context. The injected code executes within the langflow backend process, potentially allowing the attacker to read sensitive configuration data, modify workflows, or escalate privileges depending on the execution context.