CVE-2026-9186: Langflow Authentication Bypass Vulnerability

CVE-2026-9186 Overview

CVE-2026-9186 is an access control vulnerability [CWE-284] in IBM Langflow OSS versions 1.0.0 through 1.11.2. The flaw allows remote authenticated attackers to bypass a localhost-only restriction on Model Context Protocol (MCP) configuration installation. Attackers spoof the X-Forwarded-For: 127.0.0.1 header to impersonate a local request. This grants arbitrary write access to integrated development environment (IDE) configuration files such as ~/.cursor/mcp.json. The vulnerability affects Langflow deployments running on Windows, macOS, and Linux hosts.

Critical Impact
Authenticated attackers can write arbitrary MCP server configurations to developer IDE config files, enabling supply-chain-style compromise of downstream AI development tooling.

Affected Products

IBM Langflow OSS versions 1.0.0 through 1.11.2
Deployments on Apple macOS, Linux, and Microsoft Windows hosts
Integrated MCP client IDE configurations (for example, ~/.cursor/mcp.json)

Discovery Timeline

2026-09-04 - CVE-2026-9186 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-9186

Vulnerability Analysis

Langflow exposes an MCP configuration installation endpoint that is intended to be reachable only from the loopback interface. The server enforces this restriction by inspecting request headers rather than the underlying TCP peer address. An authenticated remote attacker submits an HTTP request with an X-Forwarded-For: 127.0.0.1 header. The application treats the request as originating from localhost and proceeds to write MCP server entries into IDE configuration files on the host filesystem.

The impact centers on integrity. Once malicious MCP servers appear in files such as ~/.cursor/mcp.json, downstream AI-assisted development tools load and execute them. This provides a pivot into the developer workstation environment and any credentials or source repositories accessible to that user.

Root Cause

The root cause is improper access control [CWE-284]. The application trusts a client-controlled header as an authoritative source of the request origin. Proxy-related headers such as X-Forwarded-For must not be used for security decisions unless the deployment includes a trusted reverse proxy that sanitizes them.

Attack Vector

Exploitation requires network access to a Langflow instance and valid authenticated credentials. The attacker issues a crafted HTTP POST to the MCP configuration installation endpoint with the spoofed forwarded-for header. The server writes attacker-controlled JSON to IDE configuration files under the account running the Langflow process. No user interaction is required at the time of exploitation, though impact is realized when a developer next launches the affected IDE.

No verified public exploit code is available at this time. Refer to the IBM Support Page for vendor guidance.

Detection Methods for CVE-2026-9186

Indicators of Compromise

Unexpected entries in MCP configuration files such as ~/.cursor/mcp.json, ~/.codeium/mcp.json, or equivalent per-user IDE configuration paths.
HTTP requests to Langflow MCP install endpoints containing X-Forwarded-For: 127.0.0.1 from non-local source IP addresses.
File modification events on IDE config files where the writing process is the Langflow service account rather than the IDE itself.

Detection Strategies

Correlate web server access logs with source IP address versus forwarded-for header values to surface spoofing attempts against Langflow endpoints.
Monitor for HTTP requests that target MCP installation routes and originate from external network segments.
Baseline the expected contents of developer IDE MCP configuration files and alert on unauthorized additions or modifications.

Monitoring Recommendations

Enable file integrity monitoring on user-profile MCP configuration files across developer workstations.
Forward Langflow application and reverse-proxy logs to a centralized analytics platform for header inspection and anomaly detection.
Track outbound network connections initiated by IDE processes after MCP config changes to identify malicious MCP server callbacks.

How to Mitigate CVE-2026-9186

Immediate Actions Required

Upgrade Langflow OSS to a version later than 1.11.2 that addresses the header trust flaw, per the IBM Support Page.
Audit all IDE MCP configuration files on hosts that connect to Langflow instances and remove unrecognized entries.
Restrict Langflow authentication to trusted users and rotate credentials for accounts that may have been abused.

Patch Information

IBM has published remediation guidance and fixed-version information on the IBM Support Page for Langflow OSS. Administrators should apply the vendor-supplied update covering versions 1.0.0 through 1.11.2.

Workarounds

Terminate X-Forwarded-For headers at a trusted reverse proxy and strip or overwrite the value before forwarding requests to Langflow.
Bind Langflow's MCP installation interface to the loopback address at the network layer, using firewall rules or a service-level bind restriction rather than relying on header inspection.
Remove or disable MCP integrations on Langflow instances that do not require them until the patch is applied.

bash

# Example nginx directive to strip client-supplied forwarded headers
# before proxying to a Langflow backend
location / {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://langflow_backend;
}