IBM Langflow OSS CVE-2026-7803

Exploitation requires the ability to submit or import a flow definition to a Langflow OSS instance (versions 1.0.0-1.10.0) where the node carries a missing or empty component type field - that malformed-node condition is the specific trigger. Per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication, user interaction, or special complexity required against a reachable instance, so the practical limiting factor is network exposure of the Langflow API/UI: an instance bound to localhost or restricted behind an authenticating proxy is not exploitable by anonymous remote attackers. Note the PR:N claim is vendor/NVD-assigned; confirm whether your deployment enables authentication, as that materially changes reachability.

Signals are mostly aligned toward high priority but partly unverified. The CVSS 3.1 base score of 9.8 with AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H describes trivially-reachable, unauthenticated network RCE - the worst-case profile. However, this is tempered by missing corroborating signals: there is no EPSS score provided, no CISA KEV listing (so no confirmed active exploitation), and no public POC referenced, so the real-world exploitation likelihood cannot be quantified from the input. No SSVC decision data was supplied. The PR:N rating implies no authentication is needed, but reaching the flow-creation API in many deployments still depends on whether the Langflow server is exposed and whether auth is enabled - verify exposure before treating this as internet-wide critical. Net: treat as a high-priority patch item given the RCE class and prior history of unauthenticated RCE in Langflow, while recognizing that exploitation-probability evidence (EPSS/KEV/POC) is absent rather than confirmed-low.

An attacker who can reach the Langflow API sends a crafted flow definition containing a node with a missing or empty component type field; the server's flawed validation accepts the malformed node and processes it into an execution path that runs attacker-supplied code on the host. Given AV:N/AC:L/PR:N, this requires only network access to a vulnerable instance and no authentication or user interaction. No public proof-of-concept is identified at time of analysis, though Langflow has a history of similar unauthenticated RCE flaws.