What is the CVSS score of CVE-2026-7803?

CVE-2026-7803 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow OSS are affected by CVE-2026-7803?

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability exploitable without authentication.. A patch is available.

How to fix or mitigate CVE-2026-7803?

Within 24 hours: Inventory all IBM Langflow OSS deployments and document versions, network accessibility, and data sensitivity. Within 7 days: Apply vendor-released patch to upgrade all affected instances to the patched version specified in the IBM security advisory. Within 30 days: Complete vulnerability remediation across all environments and implement network-based access controls limiting Langflow exposure to authorized users only.

IBM Langflow OSS CVE-2026-7803

EUVD-2026-40383 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 ibm

GHSA-qrxw-fw7h-wjxj

RCE IBM Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable flow API with no authentication or interaction yields code execution, giving full confidentiality/integrity/availability impact; PR:N retained per vendor vector though it assumes auth is disabled.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 19:53 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

AnalysisAI

Arbitrary code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows remote attackers to run code on the host by submitting flow definitions containing nodes with missing or empty component type fields. The improper input validation (CWE-20) lets malformed node specifications bypass type checks and reach unsafe execution paths in the low-code AI workflow engine. The CVSS vector (AV:N/PR:N) indicates network-reachable, pre-authentication exploitation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Langflow is a popular open-source, Python-based low-code platform for visually building LLM and AI-agent pipelines, where users compose 'flows' from typed component nodes that the backend instantiates and executes. The CPE cpe:2.3:a:ibm:langflow_oss confirms the affected software is the IBM-stewarded Langflow OSS distribution. The root cause is CWE-20 (Improper Input Validation): the flow-processing logic does not properly reject nodes whose component type field is absent or empty, so an attacker-controlled flow node can drive the engine into an unintended code path that results in code execution rather than a safe validation error. Because Langflow dynamically loads and runs component logic, weak validation of node metadata is directly security-relevant.

RemediationAI

Upgrade IBM Langflow OSS to the fixed release identified in the IBM advisory at https://www.ibm.com/support/pages/node/7278445 (patch available per vendor advisory; an exact fixed version number is not stated in the input and should be taken from that page). Until patched, do not expose the Langflow server directly to untrusted networks - restrict the web UI and flow-execution API to a trusted management network or VPN, and place it behind an authenticating reverse proxy so anonymous users cannot submit flow definitions; the trade-off is reduced accessibility for legitimate remote users and added proxy maintenance. Where feasible, run Langflow under a low-privilege, sandboxed/containerized service account to limit the blast radius of any code execution, accepting that this contains rather than prevents exploitation. Monitor flow-creation and execution endpoints for malformed node payloads as a detective control.