IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). Remote authenticated attackers can bypass localhost-only restrictions intended to limit access and write arbitrary MCP server configurations to IDE configuration files on the host system. This improper validation of input allows unauthorized configuration changes, which may compromise system integrity. The CVSS 3.1 base score is 8.5, reflecting high impact on integrity with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows remote authenticated attackers to bypass intended localhost-only access restrictions and write arbitrary configurations to critical IDE configuration files. This can lead to unauthorized modification of system configurations, potentially enabling privilege escalation or further compromise of the host environment. Confidentiality impact is low, integrity impact is high, and availability is not affected.

No official patch or remediation guidance is currently available from IBM. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users only and monitor for suspicious configuration changes. Avoid exposing the affected service to untrusted networks.