vulnerability · Wed 07 Oct 2026 · 16:18 UTC
GHSA-4f6c-2vvp-gw82: Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Filed UTCSource GTH ↗
Description: ### Summary An IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability — CVSS 7.1
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-105741 | — | 0.21% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.