CVE-2026-7803 - Flow Validation Bypass via Empty Component Type Field

Back Back to CVE browser

CRITICAL

Flow Validation Bypass via Empty Component Type Field

Published Jun 30, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.64%

Description

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

Affected products

Vendor IBM Product Langflow OSS Default
unknown
Affected
- ≥ 1.0.0, ≤ 1.10.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
IBM	Langflow OSS	unknown	Affected ≥ 1.0.0, ≤ 1.10.0

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.1 https://pypi.org/project/langflow/

Weaknesses (1)

CWE-20

Improper Input Validation

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40383
Advisory
https://www.ibm.com/support/pages/node/7278445
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40383		Advisory
https://www.ibm.com/support/pages/node/7278445		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Jun 30, 2026

Updated Jul 1, 2026

Reserved May 4, 2026

Link CVE-2026-7803

CISA Vulnrichment

Updated Jun 30, 2026

NVD

Status Analyzed

Modified Jul 2, 2026

Link CVE-2026-7803

Red Hat

No data

ENISA EUVD

Assigner ibm

Published Jun 30, 2026

Updated Jul 1, 2026

Link EUVD-2026-40383

GitHub

No data