Description
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected products
- langflow-ai / langflow>= 1.5.0, < 1.10.3 – >= 1.5.0, < 1.10.3
References
- VENDOR_ADVISORYhttps://github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2vvp-gw82
- PATCHhttps://github.com/langflow-ai/langflow/pull/13915
- PATCHhttps://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72
- PATCHhttps://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639
- PATCHhttps://github.com/langflow-ai/langflow/releases/tag/v1.10.3
Updated 41m ago · 8 sources