Executive Summary

This vulnerability exists in the langflow-ai langflow software up to version 1.8.3, specifically in the function get_client_ip/install_mcp_config within the file src/backend/base/langflow/api/v1/mcp_projects.py. It involves the manipulation of the X-Forwarded-For argument, which leads to an injection attack. This means an attacker can remotely exploit this vulnerability by sending crafted input to manipulate the system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows remote attackers to perform injection attacks by manipulating the X-Forwarded-For header. This can lead to unauthorized actions or data manipulation within the affected component, potentially compromising the integrity and availability of the system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated remote attackers to bypass local-only access restrictions by spoofing the X-Forwarded-For header, enabling arbitrary remote configuration writes to the Model Context Protocol settings. This can lead to unauthorized modification of server configurations and potential further exploitation.

Such unauthorized access and configuration manipulation could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over access to systems and protection of sensitive data. The ability to bypass network-level security boundaries and alter configurations remotely may violate requirements for data integrity, confidentiality, and access control.

However, the provided information does not explicitly mention direct effects on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the Langflow MCP configuration installation endpoint for suspicious use of the X-Forwarded-For header, especially if it contains spoofed local IP addresses like 127.0.0.1.

A practical way to detect exploitation attempts is to look for POST requests to the endpoint /api/v1/mcp/project/<project_id>/install that include the X-Forwarded-For header set to 127.0.0.1 or other local IPs.

Example command using curl to test if the vulnerability is present (requires valid authentication token and project_id):

• curl -X POST "http://<server-ip>:7860/api/v1/mcp/project/<project_id>/install" -H "Authorization: Bearer <your_token>" -H "X-Forwarded-For: 127.0.0.1" -H "Content-Type: application/json" -d '{"mcp_path": "/root/.cursor/mcp.json"}'

If the server responds with HTTP 200 OK and modifies or creates the specified configuration file, it indicates the vulnerability is exploitable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Langflow to a version later than 1.7.3 where the vulnerability is patched by properly validating the source of the X-Forwarded-For header or avoiding blind trust of this header.

If upgrading is not immediately possible, restrict access to the MCP configuration installation endpoint to trusted internal networks or localhost only via network-level controls such as firewall rules.

Additionally, monitor and log requests to the vulnerable endpoint for suspicious X-Forwarded-For header values and unauthorized configuration changes.

Useful 0 Not Useful 0