CVE-2026-6599

BRIEFING NOTE: CVE-2026-6599 This vulnerability affects Langflow AI's Langflow application versions up to 1.8.3 and exists in the Model Context Protocol Configuration API component. The flaw stems from improper validation of the X-Forwarded-For HTTP header in the get_client_ip and install_mcp_config functions, allowing remote attackers to perform injection attacks through header manipulation. The vulnerability presents a medium severity risk with a CVSS score of 6.3, accessible remotely with low attack complexity and requiring only low privileges. Successful exploitation could result in limited confidentiality, integrity, and availability impacts. The EPSS score of 0.00041 indicates this threat ranks higher than approximately 99.9% of known vulnerabilities in terms of exploitation likelihood. Exploit code is publicly available and the vulnerability is currently listed on the CISA Known Exploited Vulnerabilities catalog as active, signaling real-world exploitation attempts. The vendor was notified early in the disclosure process but provided no response. Organizations running affected versions should prioritize assessment and patching efforts accordingly.