EUVD-2026-23762Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get_client_ip/install_mcp_config of the file src/backend/base/langflow/api/v1/mcp_projects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument X-Forwarded-For results in injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in langflow-ai langflow up to version 1.8.3 allows authenticated remote attackers to execute arbitrary code via manipulation of the X-Forwarded-For HTTP header in the Model Context Protocol Configuration API endpoint. The vulnerability affects the get_client_ip function in src/backend/base/langflow/api/v1/mcp_projects.py and has publicly available exploit code; the vendor did not respond to early disclosure notification.
Technical ContextAI
The vulnerability resides in the Model Context Protocol (MCP) Configuration API component of langflow, specifically in the get_client_ip and install_mcp_config functions. The root cause is improper input validation of the X-Forwarded-For HTTP header (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The X-Forwarded-For header is commonly used in reverse proxy scenarios to communicate the original client IP address; however, this header is user-controlled and can contain arbitrary values. When the get_client_ip function processes this header without proper sanitization before passing it downstream to the install_mcp_config function, an attacker can inject code (likely Python code given the backend context) that will be interpreted rather than treated as literal data. The affected CPE is cpe:2.3:a:langflow-ai:langflow:*:*:*:*:*:*:*:* with versions up to 1.8.3 confirmed vulnerable.
RemediationAI
Upgrade langflow to a version released after 1.8.3 that includes a patch for the X-Forwarded-For header injection vulnerability; however, no specific patched version is confirmed in available data due to lack of vendor response. Organizations unable to upgrade immediately should implement network-level controls: disable or restrict access to the Model Context Protocol Configuration API endpoints (specifically the install_mcp_config function in src/backend/base/langflow/api/v1/mcp_projects.py) by limiting IP ranges or requiring VPN access. Additionally, configure web application firewalls to sanitize or block X-Forwarded-For headers containing suspicious characters or code patterns, or remove X-Forwarded-For headers entirely if the reverse proxy configuration does not legitimately require this header. Monitor API logs for unusual X-Forwarded-For values. Note that WAF filtering is a temporary measure and does not address the root cause; patching remains the primary remediation.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today