CVE-2026-105741Published
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-105741 · Microsoft / collected KEV context
cve-program · CVE-2026-105741
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2vvp-gw82
- https://github.com/langflow-ai/langflow/pull/13915
- https://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72
- https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639
- https://github.com/langflow-ai/langflow/releases/tag/v1.10.3
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.