CyberRota Analysis
AI-GeneratedLangflow versions 1.5.0 to 1.10.3 are vulnerable to an IP spoofing attack via the Model Context Protocol (MCP) configuration installation endpoint, allowing authenticated remote attackers to bypass local access restrictions. By exploiting this flaw, attackers can manipulate server requests to overwrite MCP client configuration files, potentially compromising the integrity of the system. Organizations using affected versions should prioritize upgrading to 1.10.3 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.