CVE-2026-105741: Langflow IP Spoofing Bypass for Configuration Write

# CVE-2026-105741: Langflow IP Spoofing Bypass for Configuration Write

https://gcdradar.vercel.app/incidents/cve-2026-105741-langflow-ip-spoofing-bypass-for-configuratio · AIR-2026-0231 · closed 2026-10-05

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-10-05
- AI role: Attack on AI
- Products: Langflow
- CVE ids: CVE-2026-105741
- CVSS: 7.1

## Summary

An IP spoofing vulnerability in Langflow's MCP configuration installation endpoint allows remote attackers to bypass localhost access restrictions using a forged header. This enables unauthorized writing or overwriting of client configuration files on the server filesystem.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-07: CVE-2026-105741: Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write (https://github.com/advisories/GHSA-4f6c-2vvp-gw82)
- 2026-10-05: CVE-2026-105741: Langflow is a tool for building and deploying AI-powered agents and workflows. (https://nvd.nist.gov/vuln/detail/CVE-2026-105741)

## Sources

- 2026-10-05 NVD: CVE-2026-105741: Langflow is a tool for building and deploying AI-powered agents and workflows. https://nvd.nist.gov/vuln/detail/CVE-2026-105741
- 2026-10-07 GitHub Advisory Database: CVE-2026-105741: Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write https://github.com/advisories/GHSA-4f6c-2vvp-gw82

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.