Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Description: Summary An IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1...