CVE-2026-6599: 
LangFlow vulnerability analysis and mitigation

CVE-2026-6599 is an injection vulnerability in langflow-ai langflow affecting versions up to and including 1.8.3. The flaw resides in the get_client_ip/install_mcp_config functions within src/backend/base/langflow/api/v1/mcp_projects.py, part of the Model Context Protocol (MCP) Configuration API. An authenticated remote attacker can manipulate the X-Forwarded-For HTTP header to trigger injection. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium); GitHub Advisory Database rates it Low (2.1 overall) (GitHub Advisory, VulDB). The vulnerability was published on April 20, 2026; the vendor was contacted prior to disclosure but did not respond (GitHub Advisory).

The root cause is improper neutralization of special elements in the X-Forwarded-For header value before it is passed to downstream components, classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component — 'Injection') and CWE-707 (Improper Neutralization) (GitHub Advisory). The vulnerable code path is in mcp_projects.py, where the get_client_ip function reads the X-Forwarded-For header without adequate sanitization and passes the value to install_mcp_config, which uses it in a downstream operation (VulDB). Exploitation requires low-privilege authenticated access and no user interaction; attack complexity is low. A public proof-of-concept has been published as a GitHub Gist (PoC Gist).

Successful exploitation can result in low-level compromise of confidentiality, integrity, and availability of the affected langflow instance. An authenticated attacker may be able to inject malicious data into MCP configuration operations, potentially causing unauthorized information disclosure, unauthorized modification of MCP project configuration data, or limited service disruption (GitHub Advisory, VulDB). Subsequent system impact (lateral movement beyond the vulnerable system) is assessed as none based on current CVSS v4.0 scoring (GitHub Advisory).

A public proof-of-concept exploit has been published as a GitHub Gist by the reporter (chenhouser2025), making weaponization accessible (PoC Gist). The CVSS v4.0 exploit maturity is rated "Proof of Concept" (GitHub Advisory). The EPSS score is approximately 0.041–0.053%, placing it in the 17th percentile for exploitation probability within 30 days (GitHub Advisory). There is no confirmed evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not currently listed in the CISA KEV catalog.

1. Authentication: Obtain low-privilege credentials for a target langflow instance running version 1.8.0–1.8.3 (e.g., via a registered user account).
2. Identify the target endpoint: Locate the Model Context Protocol Configuration API endpoint, specifically the install_mcp_config route handled in src/backend/base/langflow/api/v1/mcp_projects.py.
3. Craft a malicious request: Construct an authenticated HTTP request to the MCP configuration endpoint and inject a malicious payload into the X-Forwarded-For header (e.g., X-Forwarded-For: 127.0.0.1, <injected_payload>).
4. Trigger injection: Submit the request; the get_client_ip function reads the unsanitized header value and passes it to install_mcp_config, where it is processed by a downstream component without proper neutralization.
5. Achieve objective: Depending on the downstream component's behavior, the injected value may alter MCP configuration data, disclose information, or cause unexpected application behavior (GitHub Advisory, PoC Gist).

• Network: Unusual or repeated authenticated HTTP requests to the MCP Configuration API endpoint (/api/v1/mcp_projects/) containing anomalous X-Forwarded-For header values (e.g., multiple IPs, special characters, or non-standard formatting).
• Logs: Application access logs showing requests to mcp_projects.py-handled routes with X-Forwarded-For values containing injection characters (e.g., commas followed by unexpected strings, newlines, or encoded payloads); error traces in langflow application logs related to MCP configuration processing.
• File System: Unexpected modifications to MCP project configuration files or database entries following API calls to the affected endpoint.
• Process: Anomalous behavior in the langflow backend process following MCP configuration API calls, such as unexpected subprocess spawning or file writes.

As of the disclosure date (April 20, 2026), no official patched version has been released by langflow-ai, and the vendor did not respond to the researcher's disclosure (GitHub Advisory). Organizations should immediately restrict network-level access to the MCP Configuration API and implement proxy or WAF rules to strip or validate X-Forwarded-For headers before they reach the application. Access to the affected API should be limited to only authorized, trusted users and services, and all versions 1.8.0 through 1.8.3 should be treated as vulnerable until an official patch is available. Monitor official langflow releases and the GitHub Advisory (GHSA-v66p-f7x3-4794) for patch availability (GitHub Advisory).

The vulnerability was noted on Bluesky via the CVE tracking account shortly after publication, indicating some community awareness (Bluesky Post). The vendor (langflow-ai) did not respond to the researcher's pre-disclosure contact, which was noted in the advisory and may draw criticism from the security community (GitHub Advisory). No significant vendor statements, major media coverage, or notable researcher commentary beyond the initial VulDB submission and GitHub advisory have been identified.