Disclosed weakness · no CVE recorded

Langflow remote MCP tool schemas can overwrite reserved connection fields

Langflow · MCP Tools component

First documented disclosure · Review checkpoint

Summary

A connected tool server can influence component settings by reusing names reserved for the connection.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer supplied regression tests. The reviewed sources do not document hostile use or a compromised customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Remote tool definitions and their arguments can collide with fields used for server selection, headers, TLS, caching and timeouts. The fix rejects reserved names before discovery and execution.

Conditions required

A Langflow workflow uses the MCP Tools component with a server that can supply an untrusted schema.

Potential impact

Connection configuration and tool selection can be altered. The tests document field collisions, without demonstrating credential theft or host code execution.

Affected versions and configurations

Pre-fix code on the 1.13 and 1.12 release lines. An exact first affected version is not documented in the reviewed sources.

Fix and mitigation status

1.13.1, or the 1.12.9 backport on the 1.12 line. Both final packages were published November 4.

Practical next steps

Upgrade to 1.13.1 or the 1.12.9 backport, then reconnect and test tool discovery with server-owned configuration.

Operating lesson

Keep remote tool arguments in a separate namespace from the settings that determine which tool host to trust.

Evidence and limits

The issue date is the public fix proposal. The November 4 package release is the remediation milestone. The reviewed maintainer records give no exact CVE mapping or CVSS score.

Sources