# CVE-2026-105741: Langflow IP spoofing in MCP configuration installation

Source: https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105741 · Severity: high · CVSS 7.1 · Published 2026-10-05

Langflow is a platform for building AI-powered workflows and agents. An authenticated attacker could spoof their IP address using a crafted HTTP header to bypass local-only access restrictions on a critical endpoint that writes files to the server. This allows an attacker to inject malicious MCP (Model Context Protocol) configurations onto the server, potentially enabling code execution or system compromise.

Technologies: [Langflow-Ai Langflow](https://junglewise.ai/threats/technologies/langflow-ai-langflow), [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [Langflow-Ai](https://junglewise.ai/threats/vendors/langflow-ai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-105741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105741 being exploited in the wild.

**How severe is CVE-2026-105741?** High severity, with a CVSS score of 7.1, published 5 October 2026.

**Which products and versions are affected?** Langflow-Ai Langflow 1.5.0 to 1.10.2; langflow (PyPI) >= 1.5.0, < 1.10.3, ECOSYSTEM:introduced=1.5.0,fixed=1.10.3.

**Is there a fix for CVE-2026-105741?** Yes. langflow (PyPI): upgrade to 1.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105741 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105741?** Check whether you run Langflow-Ai Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.10.3 or later

  ```sh
  pip install "langflow>=1.10.3"
  ```


## Technical details

The POST /api/v1/mcp/project/{project_id}/install endpoint relies on IP-based access control to restrict file writes to localhost requests. However, the server incorrectly trusts the client-supplied X-Forwarded-For HTTP header to determine the request origin, allowing an authenticated remote attacker to spoof 127.0.0.1 and bypass the locality check (CWE-348). An attacker can write or overwrite MCP client configuration files on the server filesystem. The fix validates the real TCP peer address instead of trusting forwarded headers unless a trusted proxy is explicitly configured.

## Affected products

- Langflow AI Langflow 1.5.0 to 1.10.2

## Identifiers

- CVE-2026-105741
- GHSA-4f6c-2vvp-gw82
- PYSEC-2026-4229

## Timeline

- 2026-10-05: disclosed
- 2026-07-14: patched

## References

- [https://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72](https://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72)
- [https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639](https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow command injection in MCP server configuration](https://junglewise.ai/threats/cve-2026-105740-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)