CVE-2026-6599: Langflow injection through X-Forwarded-For in MCP project configuration API

Summary

A vulnerability was detected in langflow-ai langflow up to 1.8.3. The flaw sits in the function get_client_ip/install_mcp_config in src/backend/base/langflow/api/v1/mcp_projects.py, part of the Model Context Protocol Configuration API. Manipulating the X-Forwarded-For argument results in injection, and the attack may be initiated remotely. A public exploit exists, and the vendor did not respond to early disclosure.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langflowPyPIReaches an LLM package through dependencies

Related items

• InfoResearchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six DaysSimilar attack · The Hacker News
• MediumAn AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.Similar attack · The Hacker News
• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer