Langflow EUVD-2026-92800

Requires a valid authenticated session on Langflow versions 1.5.0 up to (but not including) 1.10.3 (PR:L in the CVSS vector), and network reachability to the MCP install endpoint POST /api/v1/mcp/project/{project_id}/install. The concrete trigger is a request carrying a forged 'X-Forwarded-For: 127.0.0.1' (or any loopback address) header, which the pre-fix get_client_ip trusted as the leftmost entry, satisfying the is_local_ip local-only gate. Limiting factors: authentication is mandatory (no anonymous exploitation), no user interaction is needed, and the impact is bounded to writing/overwriting an MCP client configuration file. The fix makes the header untrusted by default, only honoring the rightmost XFF entry when the operator has explicitly set rate_limit_trust_proxy - so deployments on 1.10.3+ with that setting still relying on a properly configured trusted proxy are safe.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1 High) is internally consistent with the description: network-reachable, low complexity, but requiring low-level authentication (PR:L), with a high integrity impact (arbitrary write/overwrite of an MCP client config file on the host) and low availability impact and no confidentiality loss. The key mitigating signal is PR:L - this is NOT an unauthenticated flaw; an attacker must already hold valid Langflow credentials, which substantially narrows the realistic threat to authenticated-but-unprivileged users or attackers with stolen/low-tier accounts. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was supplied (the GitHub links are the fix commits, PR, and advisory - not weaponized exploit code). The practical danger is elevation/abuse: because the endpoint writes an MCP client configuration (e.g., ~/.cursor/mcp.json) to the host filesystem, a poisoned config could point tooling at attacker-controlled MCP servers, creating a plausible path to downstream code execution or data redirection - so the true business impact may exceed the raw integrity-only CVSS framing. Note one nuance to verify: the description frames the endpoint as 'local-only,' implying an intended trust boundary, yet the CVSS AV:N correctly reflects that the bypass itself is performed remotely via a spoofed header.

An authenticated low-privilege Langflow user (or an attacker who has obtained any valid session) sends a POST to /api/v1/mcp/project/{project_id}/install with a forged 'X-Forwarded-For: 127.0.0.1' header; the server trusts the leftmost XFF entry, treats the request as loopback-originated, and bypasses the local-only guard, allowing the attacker to write or overwrite an MCP client configuration file on the server's filesystem. No public exploit code was identified at time of analysis, though the upstream fix commits and regression tests publicly document the exact spoofing technique and the vulnerable is_local_ip/get_client_ip logic.