A flaw in the Model Context Protocol Configuration API allows a remote attacker to inject malicious data by manipulating the X‑Forwarded‑For HTTP header. The injection originates in the get_client_ip/install_mcp_config function of the mcp_projects module, which does not properly sanitize user input. This weakness is identified as CWE‑707 (Improper Restriction of Values for Generated Code) and CWE‑74 (Improper Handling of User Controlled Input). The exploitation yields code execution or other injection outcomes, with the public exploit already available, making the vulnerability practical for attackers.

The affected product is Langflow version 1.8.3 and earlier, released by langflow‑ai. The vulnerability resides in src/backend/base/langflow/api/v1/mcp_projects.py within the Model Context Protocol Configuration API component. No other vendors or products are listed as impacted.

The CVSS score of 5.3 classifies this as a medium‑severity vulnerability. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that the exploitation probability is currently uncertain. However, the attack vector is remote, based on crafted HTTP headers that can be sent from any internet‑connected client, and the exploit is publicly documented. The lack of a vendor response suggests that a patch may not yet be released, elevating the risk for exposed installations.