Quick answers
- Is CVE-2026-105741 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105741 being exploited in the wild.
- How severe is CVE-2026-105741?
- High severity, with a CVSS score of 7.1, published 5 October 2026.
- Which products and versions are affected?
- Langflow-Ai Langflow 1.5.0 to 1.10.2; langflow (PyPI) >= 1.5.0, < 1.10.3, ECOSYSTEM:introduced=1.5.0,fixed=1.10.3.
- Is there a fix for CVE-2026-105741?
- Yes. langflow (PyPI): upgrade to 1.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-105741 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-105741?
- Check whether you run Langflow-Ai Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- langflow (PyPI): upgrade to 1.10.3 or later
pip install "langflow>=1.10.3"
Technical details
The POST /api/v1/mcp/project/{project_id}/install endpoint relies on IP-based access control to restrict file writes to localhost requests. However, the server incorrectly trusts the client-supplied X-Forwarded-For HTTP header to determine the request origin, allowing an authenticated remote attacker to spoof 127.0.0.1 and bypass the locality check (CWE-348). An attacker can write or overwrite MCP client configuration files on the server filesystem. The fix validates the real TCP peer address instead of trusting forwarded headers unless a trusted proxy is explicitly configured.
Affected products
- Langflow AI Langflow 1.5.0 to 1.10.2
Identifiers
- CVE-2026-105741
- GHSA-4f6c-2vvp-gw82
- PYSEC-2026-4229
Timeline
- 2026-10-05: disclosed
- 2026-07-14: patched