CVE-2026-7803CWE-20

Flow Validation Bypass via Empty Component Type Field

Critical · published June 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-06-30T19:15Z
EPSS history
Timeline
  • 30 JUN 19:15Z
    Flow Validation Bypass via Empty Component Type Field
    cvelistv5