CVE-2026-6599
Remote Injection via X-Forwarded-For in Langflow Model API
Publication date: 2026-04-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langflow-ai | langflow | to 1.8.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-707 | The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated remote attackers to bypass local-only access restrictions by spoofing the X-Forwarded-For header, enabling arbitrary remote configuration writes to the Model Context Protocol settings. This can lead to unauthorized modification of server configurations and potential further exploitation.
Such unauthorized access and configuration manipulation could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over access to systems and protection of sensitive data. The ability to bypass network-level security boundaries and alter configurations remotely may violate requirements for data integrity, confidentiality, and access control.
However, the provided information does not explicitly mention direct effects on compliance with these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the Langflow MCP configuration installation endpoint for suspicious use of the X-Forwarded-For header, especially if it contains spoofed local IP addresses like 127.0.0.1.
A practical way to detect exploitation attempts is to look for POST requests to the endpoint /api/v1/mcp/project/<project_id>/install that include the X-Forwarded-For header set to 127.0.0.1 or other local IPs.
Example command using curl to test if the vulnerability is present (requires valid authentication token and project_id):
- curl -X POST "http://<server-ip>:7860/api/v1/mcp/project/<project_id>/install" -H "Authorization: Bearer <your_token>" -H "X-Forwarded-For: 127.0.0.1" -H "Content-Type: application/json" -d '{"mcp_path": "/root/.cursor/mcp.json"}'
If the server responds with HTTP 200 OK and modifies or creates the specified configuration file, it indicates the vulnerability is exploitable.
Can you explain this vulnerability to me?
This vulnerability exists in the langflow-ai langflow software up to version 1.8.3, specifically in the function get_client_ip/install_mcp_config within the file src/backend/base/langflow/api/v1/mcp_projects.py. It involves the manipulation of the X-Forwarded-For argument, which leads to an injection attack. This means an attacker can remotely exploit this vulnerability by sending crafted input to manipulate the system.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to perform injection attacks by manipulating the X-Forwarded-For header. This can lead to unauthorized actions or data manipulation within the affected component, potentially compromising the integrity and availability of the system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Langflow to a version later than 1.7.3 where the vulnerability is patched by properly validating the source of the X-Forwarded-For header or avoiding blind trust of this header.
If upgrading is not immediately possible, restrict access to the MCP configuration installation endpoint to trusted internal networks or localhost only via network-level controls such as firewall rules.
Additionally, monitor and log requests to the vulnerable endpoint for suspicious X-Forwarded-For header values and unauthorized configuration changes.