IBM Langflow MCP Server Configuration Injection via Localhost Bypass

Technical Analysis

The flaw stems from Langflow failing to properly enforce localhost-only restrictions meant to isolate MCP server configuration writes to trusted, local-only requests. An authenticated remote attacker can exploit this gap to write attacker-controlled MCP server entries directly into IDE configuration files (e.g., editor/IDE MCP client configs) on the host running Langflow. Because IDEs and agentic coding assistants often auto-load and trust MCP servers listed in these config files, the attacker gains a path to have their malicious MCP server invoked with the privileges of the developer's tooling, enabling downstream tool-poisoning or code execution once the poisoned config is loaded. This crosses a significant boundary: from a web application vulnerability (broken access control) to persistent compromise of a developer's local agentic tool-chain, bypassing the trust assumption that only local processes can modify MCP configs.

Affected Systems

IBM Langflow OSS; protocols: MCP

Detection Signatures

• Unexpected new entries in IDE/editor MCP client configuration files (e.g., mcp.json, claude_desktop_config.json, or similar) not created by the local user
• MCP server entries referencing unfamiliar binaries, scripts, or remote URLs
• Langflow access logs showing configuration-write API calls originating from non-localhost source IPs or unexpected authenticated sessions
• File modification timestamps on IDE config files coinciding with Langflow activity
• MCP server commands with unusual arguments (e.g., curl/wget pipes, base64-encoded payloads, reverse shell patterns)

Remediation Steps

1. 1

   Upgrade Langflow

   Apply the vendor patch/upgrade beyond version 1.10.3 that restores proper localhost-only enforcement for MCP configuration writes.

2. 2

   Audit IDE/MCP config files

   Review all IDE and MCP client configuration files on hosts running Langflow for unauthorized or unrecognized server entries and remove them.

3. 3

   Restrict network exposure

   Ensure Langflow instances are not exposed to untrusted networks and enforce strict authentication/authorization on all configuration-modifying endpoints.

4. 4

   Implement MCP allowlisting

   Configure IDEs/agentic tools to only load MCP servers from an explicit, version-controlled allowlist rather than auto-trusting local config file contents.

5. 5

   Monitor and alert

   Add file integrity monitoring on IDE configuration paths and alert on writes triggered by Langflow or other automation processes.