CVE-2026-9186 - Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust · CoreCVE

Back Back to CVE browser

MEDIUM

Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Published Sep 4, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).

Affected products

Vendor IBM Product Langflow OSS Default
unknown
Affected
- ≥ 1.0.0, ≤ 1.11.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
IBM	Langflow OSS	unknown	Affected ≥ 1.0.0, ≤ 1.11.2

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.11.3 https://pypi.org/project/langflow/

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71215
Advisory
https://www.ibm.com/support/pages/node/7285646
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71215		Advisory
https://www.ibm.com/support/pages/node/7285646		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Sep 4, 2026

Updated Sep 8, 2026

Reserved May 21, 2026

Link CVE-2026-9186

CISA Vulnrichment

Updated Sep 8, 2026

NVD

Status Analyzed

Modified Sep 8, 2026

Link CVE-2026-9186

Red Hat

No data

ENISA EUVD

Assigner ibm

Published Sep 4, 2026

Updated Sep 8, 2026

Link EUVD-2026-71215

GitHub

No data