CVE-2026-105741

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105741
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105741.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105741
Aliases
  • GHSA-4f6c-2vvp-gw82
Published
2026-10-05T20:56:00Z
Modified
2026-10-07T02:47:36Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Details

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-290",
        "CWE-345"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105741.json"
}
References

Affected packages

Git / github.com/langflow-ai/langflow

Affected ranges

Type
GIT
Repo
https://github.com/langflow-ai/langflow
Events
Introduced
9ad92eaeaa935db67deca300c40ed0dffea39131
Fixed
1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72
Fixed
94859df33acd70b2a1f816e26d68f5e89a7e5639
Fixed
a8d94f9f4fb34fe488ec317bdade4e83611ef17a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.10.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105741.json"