CVE-2026-7803

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7278445	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) IBM Langflow OSS 1.0.0 hasta 1.10.0 podría permitir la ejecución de código arbitrario debido a una validación inadecuada de los nodos de flujo con campos de tipo de componente faltantes o vacíos.

Information

Published : 2026-06-30 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-7803

Mitre link : CVE-2026-7803

CVE.ORG link : CVE-2026-7803

JSON object : View

Products Affected

langflow

langflow

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2026-7803", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7803", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-30T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:langflow_oss:1.10.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Langflow OSS", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.10.0"}]}]}], "published": "2026-06-30T20:17:31.413", "references": [{"url": "https://www.ibm.com/support/pages/node/7278445", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields."}, {"lang": "es", "value": "IBM Langflow OSS 1.0.0 hasta 1.10.0 podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario debido a una validaci\u00f3n inadecuada de los nodos de flujo con campos de tipo de componente faltantes o vac\u00edos."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C7B74AA-C67C-41BB-8566-76172727777C", "versionEndIncluding": "1.10.0", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}