IBM Langflow OSS CVE-2026-9186

Exploitation requires a valid authenticated account on the IBM Langflow OSS instance (PR:L per CVSS vector) - no special privilege level beyond basic login is indicated. The attacker must be able to reach the Langflow OSS HTTP endpoint over the network and must be able to set arbitrary HTTP request headers (standard for any HTTP client or scripting tool). The vulnerability is present when Langflow OSS is configured with the MCP server configuration installation feature active and when the application resolves client IP from X-Forwarded-For without a trusted-proxy allowlist. Exploitation is limited to the integrity of files writable by the Langflow OSS process user on the server host; confidentiality and availability are not directly impacted. The indirect impact (IDE-level code execution) requires the targeted user to subsequently open an affected IDE that loads the poisoned MCP config file.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) is well-calibrated: network-exploitable, low complexity, requires authentication, and produces a high-integrity write impact. The 6.5 score accurately reflects that a valid account is the primary barrier. Real-world risk is moderate-to-elevated for development and AI-platform environments: any developer or CI service account authenticated to Langflow can silently poison the MCP configuration of the server's runtime user, causing any connected IDE to load a malicious MCP server the next time it restarts - an indirect path to developer-workstation code execution that goes beyond the CVSS integrity score alone. Even a mid-sized municipal IT team in kalisz running Langflow OSS as an internal AI workflow hub should treat this as urgent patching rather than a deferred maintenance item, because developers routinely work on high-privilege machines where IDE-level code execution equals workstation takeover. EPSS data is not provided in the input; KEV status is not listed, so this is assessed as no confirmed active exploitation at time of analysis. The absence of public exploit code reduces urgency slightly, but the technique (header spoofing) is trivially reproducible by any authenticated user without specialized tooling.

An authenticated Langflow OSS user (e.g., a developer account or a compromised CI service account) sends a crafted POST request to the MCP configuration installation endpoint, including the header X-Forwarded-For: 127.0.0.1. The application accepts the spoofed loopback address and treats the request as originating from localhost, writing attacker-supplied MCP server configuration content to ~/.cursor/mcp.json on the server host. The next time a developer opens Cursor IDE on that machine, the IDE connects to the attacker's MCP server, which can return malicious tool responses to execute arbitrary code in the developer's context.