Disclosed weakness · no CVE recorded

Langflow agentic MCP requests can follow a caller-selected destination

Langflow · Agentic MCP internal HTTP client

First documented disclosure · Review checkpoint

Summary

Internal tool calls could be directed away from the configured backend listener.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer supplied regression tests. The reviewed sources do not document hostile use or a compromised customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The internal client derived its destination from request context. The fix pins the network connection to the real listener, confines redirects to the configured origin and avoids environment proxies.

Conditions required

Ability to reach the affected agentic MCP HTTP route and influence the incoming host or outbound routing. Credential exposure depends on what the affected client sends.

Potential impact

Requests and their attached credentials could reach an unintended destination. Maintainer tests exercise routing and TLS checks, without establishing external exfiltration.

Affected versions and configurations

Pre-fix code on the 1.13 and 1.12 release lines. An exact first affected version is not documented in the reviewed sources.

Fix and mitigation status

1.13.1, or the 1.12.9 backport on the 1.12 line. Both final packages were published November 4.

Practical next steps

Upgrade to 1.13.1 or the 1.12.9 backport. Verify listener and proxy settings, then inspect external destinations contacted by the affected service.

Operating lesson

Build internal callback destinations from trusted server configuration and verify the network peer even when the hostname appears local.

Evidence and limits

The issue date is the public fix proposal. The November 4 package release is the remediation milestone. The reviewed maintainer records give no exact CVE mapping or CVSS score.

Sources