IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a vulnerability that allows an authenticated attacker to craft a request with a spoofed X-Forwarded-For header set to 127.0.0.1. This bypasses the localhost-only MCP configuration and enables arbitrary writes to IDE configuration files such as ~/.cursor/mcp.json. This weakness is identified as CWE-284, Access Control: Improper Access Control. While the vulnerability permits configuration tampering, it does not directly provide remote code execution; additional exploitation steps would be required to leverage the altered configuration.

The vulnerability affects IBM Langflow OSS, specifically versions 1.0.0 up to and including 1.11.2. The upgrade path to a fixed version is 1.11.3.

The CVSS score of 6.5 indicates a moderate severity. Although the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation has been reported yet. The attack requires authentication and relies on a spoofed proxy header; thus, it is primarily a remote authenticated attack vector that could be mitigated by blocking untrusted proxy headers.