CVE-2026-9186 in Langflow
Summary
by MITRE • 09/04/2026
IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in IBM Langflow versions 1.0.0 through 1.11.2 represents a critical security flaw rooted in the improper validation of client IP addresses when processing requests for Model Context Protocol configuration installations. This issue specifically affects deployments where administrators have configured the system to restrict certain operations, such as installing MCP servers or modifying IDE configurations, to localhost-only access. The core technical failure lies in the application's reliance on the X-Forwarded-For HTTP header to determine the origin of a request rather than verifying the actual TCP connection source address. In modern web architectures utilizing reverse proxies, load balancers, or CDN services, it is standard practice for these intermediary devices to append client IP addresses to the X-Forwarded-For header as requests traverse through multiple hops. However, Langflow incorrectly trusts this user-supplied metadata without sufficient validation against the actual remote address of the TCP connection established with the proxy layer.
By spoofing the X-Forwarded-For header and setting its value to 127.0.0.1 or ::1, an authenticated attacker can successfully deceive the application into believing that the request originated from the local loopback interface. This manipulation effectively bypasses the localhost-only restriction intended to limit sensitive configuration changes to trusted internal processes. Once this access control mechanism is circumvented, the attacker gains the ability to execute arbitrary writes to critical IDE configuration files located on the server's filesystem, such as ~/.cursor/mcp.json or similar paths depending on the specific integration context. This capability transforms a simple authentication bypass into a severe file write vulnerability, allowing for persistent and potentially stealthy modifications to system configurations that are typically protected from remote modification.
The operational impact of this vulnerability is significant, particularly in environments where Langflow serves as an orchestration layer for AI agents or development tools. The ability to modify MCP configuration files allows attackers to inject malicious server definitions or alter existing ones, which can lead to unauthorized data exfiltration, command execution via integrated tool calls, or the establishment of a persistent backdoor within the agent workflow. Since these configurations often dictate how external services are accessed and what permissions they hold, compromising them effectively compromises the integrity and confidentiality of the entire AI application stack. Furthermore, because this attack requires only authenticated access, it poses a substantial risk in multi-tenant environments where user isolation is critical for security compliance.
This flaw aligns with CWE-287 Improper Authentication, as the system fails to correctly verify the identity of the client relative to its intended policy constraints. It also relates closely to CWE-94 Code Injection via User-Controlled Data if the injected configuration leads to code execution through subsequent agent tool calls. From a threat modeling perspective using MITRE ATT&CK, this vulnerability facilitates Initial Access and Persistence techniques by allowing an attacker to modify system configurations without detection from standard network-based access controls that rely on source IP verification at the proxy level rather than application-level validation of connection metadata.
To mitigate this risk, organizations must immediately upgrade IBM Langflow to a version later than 1.11.2 where the issue has been addressed by implementing strict validation of both the X-Forwarded-For header and the actual remote address from which the request originates. If upgrading is not immediately feasible, administrators should configure their reverse proxies or web application firewalls to strip or overwrite untrusted X-Forwarded-For headers before they reach the Langflow instance. Additionally, enforcing strict network segmentation to ensure that only trusted internal services can access the configuration endpoints provides a necessary defense-in-depth layer. Regular auditing of configuration file integrity and monitoring for unexpected modifications to IDE settings files are also recommended practices to detect potential exploitation attempts in real-time.