by Kastro
Paper/Archive/CVE-2026-7803

CVE-2026-7803

IBM Langflow OSS — Flow Validation Bypass via Empty Component Type Field

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.8.508 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

Affected

ProductAffectedFixed inSource
Langflow OSS1.0.0 – 1.10.0–CNA

Scores by source

ibm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchibm.com/support/pages/node/7278445