CVE Intelligence
Analysis AI-assisted

CVE-2026-7803: IBM Langflow OSS: Improper Input Validation Leading to Arbitrary Code Execution

IBM has disclosed CVE-2026-7803, affecting Langflow OSS versions 1.0.0 through 1.10.0. The flaw stems from improper validation of flow nodes with missing or empty component type fields, which could allow arbitrary code execution. The record assigns a CVSS 3.1 base score of 9.8 and lists no fixed version, so administrators should consult the IBM advisory and reduce exposure in the meantime.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM published a vendor advisory covering Langflow OSS. According to the record, versions from 1.0.0 through 1.10.0 are affected by a flaw in which flow nodes with missing or empty component type fields are not properly validated, which could allow arbitrary code execution. The record is marked as analyzed and carries a CVSS 3.1 base score of 9.8 from the CNA.

Impact

  • The CVSS vector in the record indicates a network attack vector, low attack complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability.
  • If arbitrary code execution is achieved, code could run in the context of the Langflow service.
  • The weakness is classified as CWE-20, Improper Input Validation.

Affected products and versions

  • Product listed: Langflow Langflow.
  • Range listed: 1.0.0 through 1.10.0, inclusive.
  • The record lists no fixed version. Consult the IBM advisory for remediation details.

Exploitation status

The CVE is not listed as known exploited in the CISA KEV data within the record. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Identify all Langflow OSS deployments within the 1.0.0 to 1.10.0 range.
  • Check the IBM advisory for the fixed release and plan an upgrade as soon as practical, since the record provides none.
  • Until a fix is applied, restrict network access to Langflow instances, require authentication and limit who can import or create flows.
  • Treat flow definitions from untrusted sources as untrusted input.

Detection guidance

  • Review flow definitions stored in or imported into Langflow for nodes that lack a component type or have an empty one.
  • Monitor application logs and host activity from Langflow services for unexpected process execution or unusual outbound connections.
  • Keep a record of flow imports and their origin to support investigation.

Limitations of the available information

  • The record does not describe the exact trigger path, the precise conditions required, or the affected components beyond the summary.
  • No fixed version, patch identifier or workaround is listed in the record.
  • EPSS values are present (probability 0.00643, percentile 0.49451), but they are statistical estimates and not evidence of exploitation.
  • Only the CNA-provided CVSS score is listed; no other provider scores appear.

Frequently asked questions

Is CVE-2026-7803 being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted for this analysis.

Which Langflow OSS versions are affected?

The record lists Langflow OSS versions from 1.0.0 through 1.10.0, inclusive.

Is a fixed version available?

The record lists no fixed version. Check the IBM advisory for remediation details and the fixed release.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.