Executive brief
IBM Langflow OSS is a visual workflow platform for building and deploying AI applications. A flaw in its MCP configuration installation endpoint allows authenticated remote attackers to bypass localhost-only restrictions by spoofing HTTP headers, enabling unauthorized modification of sensitive configuration files on the server. This could allow attackers to inject malicious AI integration settings.
Technical details
The vulnerability is an improper access control flaw (CWE-284) in Langflow's MCP configuration installation endpoint. The endpoint enforces a local-only access restriction by checking the client IP address but blindly trusts the X-Forwarded-For HTTP header without validating the request originated from a legitimate proxy. An authenticated remote attacker can spoof the X-Forwarded-For header with 127.0.0.1 to bypass the check, enabling arbitrary writes to IDE configuration files like ~/.cursor/mcp.json. This affects versions 1.0.0 through 1.11.2; the fix is to upgrade to 1.11.3 or later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-08-28: disclosed
- 2026-09-04: advisory