CVE-2026-105741: Langflow MCP Auth Bypass Vulnerability

CVE-2026-105741 Overview

CVE-2026-105741 is an authentication bypass vulnerability in Langflow, a platform for building and deploying AI-powered agents and workflows. The flaw affects the Model Context Protocol (MCP) configuration installation endpoint POST /api/v1/mcp/project/{project_id}/install in versions 1.5.0 through 1.10.2. Authenticated remote attackers can bypass the local-only access restriction by sending a spoofed X-Forwarded-For: 127.0.0.1 header. The server treats the forged header as authoritative, allowing attackers to write or overwrite MCP client configuration files on the host filesystem. The issue is classified as [CWE-290] Authentication Bypass by Spoofing and is fixed in version 1.10.3.

Critical Impact
Remote authenticated attackers can overwrite MCP client configuration files on the Langflow server, enabling tampering with downstream agent behavior and tool invocation.

Affected Products

Langflow versions 1.5.0 through 1.10.2
Model Context Protocol (MCP) install endpoint /api/v1/mcp/project/{project_id}/install
Deployments using get_client_ip() in src/backend/base/langflow/api/v1/mcp_projects.py

Discovery Timeline

2026-10-05 - CVE-2026-105741 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105741

Vulnerability Analysis

The vulnerability resides in the MCP install endpoint, which enforces a local-only restriction to limit configuration file writes to localhost requests. The get_client_ip() helper function in src/backend/base/langflow/api/v1/mcp_projects.py consulted the X-Forwarded-For HTTP header before falling back to the real TCP peer address. Because X-Forwarded-For is client-controlled on direct connections, any authenticated remote caller could set it to 127.0.0.1 and defeat the locality check. Once the check passes, the endpoint writes an MCP client configuration file to the server's filesystem. This grants attackers persistent influence over how MCP clients connect to downstream tools and services orchestrated by Langflow.

Root Cause

The root cause is improper trust in a client-controlled HTTP header for a security decision. The locality check assumed X-Forwarded-For reflected a trusted proxy chain, but Langflow does not require a reverse proxy to be present. Without an operator opt-in for trusted proxies, the first value in the header should never be treated as the true client IP.

Attack Vector

Exploitation requires valid Langflow authentication but no elevated privileges. An attacker sends a crafted POST request to the MCP install endpoint with X-Forwarded-For: 127.0.0.1. The server bypasses the local-only restriction and writes attacker-controlled MCP configuration to disk, affecting integrity of agent tooling.

python

# Patched implementation from src/backend/base/langflow/api/v1/mcp_projects.py
def get_client_ip(request: Request) -> str:
    """Resolve the client IP for the local-only install locality check.

    ``X-Forwarded-For`` is client-controlled and must NOT be trusted by default:
    trusting it lets a remote caller spoof a loopback address and defeat the
    local-only restriction on :func:`install_mcp_config` (which writes MCP client
    config to the host filesystem). By default we use the real TCP peer
    (``request.client.host``), so a spoofed header has no effect.

    Only when the operator has explicitly opted into a trusted proxy
    (``rate_limit_trust_proxy``) do we consult ``X-Forwarded-For``, and then we
    take the rightmost entry \\u2014 the last hop added by the trusted proxy, which a
    client cannot forge.
    """

Source: GitHub Commit 1f39a4b

Detection Methods for CVE-2026-105741

Indicators of Compromise

HTTP requests to /api/v1/mcp/project/{project_id}/install containing X-Forwarded-For: 127.0.0.1 or other loopback addresses from non-local source IPs.
Unexpected creation or modification of MCP client configuration files on the Langflow host.
Authenticated API calls from external IP ranges targeting MCP management endpoints.

Detection Strategies

Inspect reverse proxy and application access logs for mismatches between TCP peer address and X-Forwarded-For values on MCP endpoints.
Alert on any POST to /api/v1/mcp/project/*/install where the TCP source is not localhost but the forwarded header claims a loopback origin.
Monitor filesystem events for writes to MCP configuration paths outside of expected administrative workflows.

Monitoring Recommendations

Enable structured HTTP request logging that captures both the socket peer and all forwarding headers.
Baseline normal MCP install activity by user and source IP, then alert on deviations.
Correlate authenticated session identifiers with originating IP addresses to spot credential abuse.

How to Mitigate CVE-2026-105741

Immediate Actions Required

Upgrade Langflow to version 1.10.3 or later, which removes default trust in X-Forwarded-For for the MCP locality check.
Audit MCP client configuration files for unauthorized modifications since deployment of affected versions.
Rotate credentials for any Langflow accounts that may have been used to exercise the MCP install endpoint.

Patch Information

The fix is published in Langflow Release v1.10.3 and documented in GHSA-4f6c-2vvp-gw82. The code change is in GitHub Commit 1f39a4b with hardening backports consolidated in GitHub Commit 94859df and Pull Request #13915.

Workarounds

Place Langflow behind a reverse proxy that strips inbound X-Forwarded-For headers before forwarding requests.
Restrict network access to the MCP install endpoint using firewall rules or ingress policies to allow only trusted hosts.
Enforce least-privilege authentication so that only administrative accounts can call MCP management APIs.

bash

# Harden Langflow deployment with release 1.10.3 environment flags
ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
ENV LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
ENV LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=false
ENV LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES=mcp-proxy,lfx
ENV LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
ENV LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true

Source: GitHub Commit 94859df