CVE-2026-105741

Executive Summary

CVE-2026-105741 is an IP spoofing / authentication bypass vulnerability (CWE-290) in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. From version 1.5.0 until 1.10.3, the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) relied on client-supplied request headers to enforce a "local-only" access restriction, allowing an authenticated remote attacker to spoof the source IP via an X-Forwarded-For: 127.0.0.1 header. Successful exploitation lets the attacker write or overwrite an MCP client configuration file on the server's filesystem, with a CVSS 3.1 base score of 7.1 (High) reflecting high integrity impact and low availability impact.

Technical Analysis

The vulnerability resides in the Langflow MCP configuration installation endpoint, reachable at POST /api/v1/mcp/project/{project_id}/install. The endpoint is intended to be restricted to local-origin requests — a common security design in developer tooling where configuration files should only be mutated by processes running on the same host.

The "local-only" restriction was implemented in a way that trusted the X-Forwarded-For header to determine the client's source address. X-Forwarded-For is a hop-by-hop header intended for use by reverse proxies and load balancers to communicate the original client address. It is trivially attacker-controlled: any client can insert an arbitrary value into the header unless an intermediary proxy explicitly strips or overwrites it. By sending X-Forwarded-For: 127.0.0.1, an attacker causes the Langflow application to evaluate the request as originating from localhost, satisfying the local-only check and granting access to the protected install logic.

This is a textbook instance of CWE-290 (Authentication Bypass by Spoofing), where a security decision is made against a value the attacker controls. The root cause is the misidentification of a proxy metadata header as a trustworthy source of client identity. Proper implementations derive the peer address from the transport layer (e.g., the actual socket peer address) or use a hardened, allow-listed proxy chain that is guaranteed to strip/overwrite forwarding headers before they reach the application.

The primary consequence of bypassing the local-only gate is a file write primitive: the endpoint's install operation writes an MCP client configuration file to the server's filesystem. Because the attacker controls the request and the project_id path segment, they can direct the write to overwrite an existing MCP client configuration, substituting attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) confirms network-reachable, low-complexity exploitation requiring low privileges (authentication to Langflow), with high integrity impact and low availability impact, and no confidentiality impact. That vector is consistent with a configuration-file overwrite that does not directly exfiltrate data but can redirect downstream MCP clients to attacker-controlled endpoints.

Note: No public PoC is available; the attack mechanism is inferred from the vulnerability class (CWE-290 / header-based IP spoofing) and the explicit behavior described in the NVD entry.

Exploitation Scenarios

Attack chain, based strictly on the NVD description:

1. Reconnaissance / target identification. The attacker identifies a reachable Langflow instance exposing the MCP install endpoint (POST /api/v1/mcp/project/{project_id}/install). Langflow deployments are frequently exposed on internal developer networks or internet-facing demo/test hosts. The attacker must hold a valid authenticated session (PR:L — low privileges required), meaning any authenticated user account is sufficient.

2. Triggering the flaw class (IP spoofing / auth bypass). The attacker crafts an HTTP request to the install endpoint and adds a request header: X-Forwarded-For: 127.0.0.1. Because the server evaluates the source against this attacker-controlled header rather than the true transport peer address, the request is treated as a localhost-originated request, and the "local-only" restriction is bypassed. No proxy manipulation is required — the header is supplied directly by the attacker.

3. Payload / execution at the vulnerability-class level. With the local-only gate satisfied, the endpoint's install action executes normally, writing/overwriting an MCP client configuration file on the server's filesystem. The attacker influences the target path via the {project_id} path parameter and controls the configuration content returned/accepted by the endpoint. Because the operation is a file write, the attacker can substitute a legitimate MCP client configuration with one that redirects that client to a malicious MCP server or otherwise alters its trusted configuration.

4. Post-exploitation impact. The overwritten MCP client configuration persists on disk. Any subsequent MCP client (agent, IDE plugin, or orchestration process) that loads the configuration could connect to attacker-controlled infrastructure, enabling downstream manipulation of AI agent behavior, tool invocation, or credential-bearing MCP sessions — a pivot from a configuration write into the supply-chain-adjacent AI toolchain. The low availability impact in the CVSS vector is consistent with possible disruption if the overwritten config renders a client non-functional.

Impact Assessment

CVE-2026-105741 has a CVSS 3.1 base score of 7.1 (High). Breaking down the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L:

• AV:N (Network): exploitable over the network — no adjacent or local access required.
• AC:L (Low complexity): the exploit is a single, well-known header manipulation; no race conditions or special conditions.
• PR:L (Low privileges): the attacker must be authenticated as any Langflow user; no administrative role required.
• UI:N (No user interaction): no victim action is needed.
• S:U (Unchanged): impact is confined to the vulnerable component's security scope.
• C:N (None): the described flaw does not directly disclose data.
• I:H (High): the attacker can write/overwrite a configuration file — a high-integrity operation on the host filesystem.
• A:L (Low): overwriting configuration may degrade availability of dependent MCP clients.

Affected systems: Langflow versions 1.5.0 through before 1.10.3 that expose the MCP install endpoint and enforce a header-based local-only check. Blast radius: any host running an affected Langflow instance reachable by an authenticated attacker, plus downstream MCP clients and AI agents that load the overwritten configuration. Because Langflow is used to build AI agents and workflows, a configuration write can propagate into automated pipelines, making the effective blast radius larger than the single host. CISA KEV status: not listed; no known in-the-wild exploitation at time of writing.

Detection Guidance

Sigma Rule

title: Langflow MCP Install Endpoint Header Spoofing (CVE-2026-105741)
id: 7c1f9a2e-3b64-4d18-9f2a-langflow-mcp-spoof
status: experimental
description: Detects requests to the Langflow MCP install endpoint carrying a spoofed X-Forwarded-For localhost value.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105741
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: langflow
detection:
  selection_uri:
    cs-uri-stem|contains: '/api/v1/mcp/project/'
    cs-uri-stem|endswith: '/install'
  selection_method:
    cs-method: 'POST'
  selection_xff:
    cs(X-Forwarded-For)|contains:
      - '127.0.0.1'
      - 'localhost'
      - '::1'
  condition: selection_uri and selection_method and selection_xff
fields:
  - c-ip
  - cs-uri-stem
  - cs(X-Forwarded-For)
falsepositives:
  - Legitimate localhost-originated requests if Langflow is co-located behind a proxy that always sets XFF to 127.0.0.1
  - Health checks performed from the host itself
level: high

YARA Rule

rule CVE_2026_105741_Langflow_MCP_XFF_Spoof
{
    meta:
        description = "Detects HTTP requests targeting the Langflow MCP install endpoint with spoofed localhost X-Forwarded-For header"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105741"
        date = "2026-01-01"
        severity = "high"

    strings:
        $uri_install = "/api/v1/mcp/project/"
        $uri_install_tail = "/install"
        $method = "POST"
        $hdr_xff = "X-Forwarded-For:"
        $hdr_xff_case = "x-forwarded-for:"
        $localhost = "127.0.0.1"
        $localhost_v6 = "::1"

    condition:
        uint16(0) == 0x4850 or   // HTTP/2 preface style fallback check not required
        (
            ($uri_install and $uri_install_tail) and
            ($method) and
            ($hdr_xff or $hdr_xff_case) and
            ($localhost or $localhost_v6)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105741 Langflow MCP install X-Forwarded-For localhost spoof attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/mcp/project/"; http.uri; content:"/install"; http.header; content:"X-Forwarded-For"; nocase; http.header; content:"127.0.0.1"; nocase; classtype:attempted-user; reference:cve,2026-105741; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105741; sid:2026105741; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5s
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      http.request.headers.x_forwarded_for : ("127.0.0.1" or "localhost" or "::1") and
      url.path : "/api/v1/mcp/project/*/install"
  ]

Splunk SPL Query

index=web OR index=proxy
| eval u = lower(coalesce(uri, cs_uri_stem, url_path, url))
| eval xff = coalesce(x_forwarded_for, "cs(X-Forwarded-For)", http_x_forwarded_for)
| where (like(u, "%/api/v1/mcp/project/%/install%"))
| where match(xff, "(?i)(127\.0\.0\.1|localhost|::1)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as client_ips by host, u, xff
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,langflow,cve-2026-105741,">
  <rule id="105741" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\/api\/v1\/mcp\/project\/.*\/install$</field>
    <field name="http.request.method">POST</field>
    <field name="http.request.headers.x_forwarded_for">127\.0\.0\.1|localhost|::1</field>
    <description>CVE-2026-105741: Langflow MCP install endpoint accessed with spoofed X-Forwarded-For localhost header</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected versions are 1.5.0 through before 1.10.3, per the NVD description. Although the vendor describes the issue as "fixed in 1.10.3," no patch artifact, commit, or advisory has been independently confirmed by any tracked source, so reliability of the fix is unverified.

1) Immediate mitigations (do not rely on the application's own header check):

• Front the Langflow instance with a reverse proxy that unconditionally strips or overwrites any client-supplied X-Forwarded-For (and other X-Forwarded-*, Forwarded, X-Real-IP) headers before they reach the backend.
• Restrict network access to the MCP install endpoint (POST /api/v1/mcp/project/{project_id}/install) to trusted hosts only — bind Langflow to loopback or an isolated management network rather than exposing it broadly.
• Enforce authentication and least privilege so that only trusted operators hold Langflow accounts (PR:L in the CVSS vector means any authenticated user can trigger this).
• Monitor the MCP client configuration files' checksums/inode for unauthorized modifications.

2) Patch / upgrade steps:

• Upgrade Langflow to version 1.10.3 or later as indicated by the NVD entry. Verify the release artifact and its signature before deployment.
• Because patch confidence is 0/4, independently confirm the fix in 1.10.3 addresses the header-trust logic (source address must be derived from the transport layer, not from attacker-controllable headers) before treating the upgrade as sufficient.
• After upgrade, validate that the endpoint rejects spoofed X-Forwarded-For values in a controlled test.

3) Long-term hardening:

• Never make authorization decisions based on client-supplied headers. Derive client identity from the transport/socket peer, and treat all proxy headers as untrusted unless set by a trusted, allow-listed intermediary.
• Apply a defense-in-depth posture: allow-list the proxy chain, use mutual authentication for administrative endpoints, and place configuration-writing operations behind an explicit privileged role.
• Instrument the CI/CD pipeline to keep Langflow and its dependencies current, and add regression tests asserting that forged X-Forwarded-For values cannot satisfy local-only checks.

References

• NVD — CVE-2026-105741: https://nvd.nist.gov/vuln/detail/CVE-2026-105741
• MITRE CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
• Langflow project (upstream release notes / 1.10.3 upgrade): https://github.com/langflow-ai/langflow
• FIRST EPSS: Not yet scored at time of writing (do not assume an EPSS value)
• CISA KEV Catalog: Not listed at time of writing — no known exploited-in-the-wild evidence; no associated threat actor campaigns identified in available data.