This vulnerability exists in langflow-ai langflow up to version 1.8.3 within the function get_client_ip/install_mcp_config located in src/backend/base/langflow/api/v1/mcp_projects.py. By manipulating the X-Forwarded-For HTTP header argument, an attacker can perform an injection attack remotely. The vulnerability impacts the Model Context Protocol Configuration API component. The CVSS 4.0 base score is 5.3, indicating medium severity. No official remediation or patch has been disclosed by the vendor, and the exploit is publicly available.

Successful exploitation of this vulnerability could allow an attacker to perform injection attacks remotely via the X-Forwarded-For header, potentially leading to unauthorized actions or data manipulation within the affected component. The medium CVSS score reflects limited impact or complexity, but the public availability of the exploit increases risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level protections such as filtering or validating the X-Forwarded-For header to mitigate injection risks until an official patch is available.