CVE-2026-7803— Flow Validation Bypass via Empty Component Type Field
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | Langflow OSS | 1.0.0≤ 1.10.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7803
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Flow Validation Bypass via Empty Component Type Field
Source: NVD (National Vulnerability Database)
Vulnerability Description
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
IBM Langflow OSS 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM Langflow OSS是美国IBM公司的一个开源的低代码可视化AI工作流构建工具，它让开发者能通过拖拽组件的方式快速搭建、部署和迭代AI智能体与RAG应用，同时支持用Python进行深度定制以集成企业系统。 IBM Langflow OSS 1.0.0版本至1.10.0版本存在输入验证错误漏洞，该漏洞源于对缺少或为空组件类型字段的流程节点验证不当，可能导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Langflow OSS | 1.0.0 ~ 1.10.0 | cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-7803
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7803
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-7803 (1)
Same Patch Batch · IBM · 2026-06-30 · 43 CVEs total
| CVE-2026-10134 | 10.0 CRITICAL | Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows |
| CVE-2026-7873 | 9.9 CRITICAL | Code Injection Vulnerability in Code Validation Endpoint |
| CVE-2026-7871 | 9.8 CRITICAL | Insecure Deserialization in Redis Cache Backend |
| CVE-2026-10109 | 9.8 CRITICAL | IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake h |
| CVE-2026-10140 | 9.6 CRITICAL | Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem |
| CVE-2026-11712 | 9.3 CRITICAL | IBM WebSphere Application Server is affected by a cross-site scripting vulnerability |
| CVE-2026-11708 | 9.3 CRITICAL | IBM WebSphere Application Server is affected by a cross-site scripting vulnerability |
| CVE-2026-7663 | 9.1 CRITICAL | Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport |
| CVE-2026-7874 | 9.1 CRITICAL | Weak Cryptographic Key Derivation Exposed All Stored Credentials |
| CVE-2026-10129 | 8.5 HIGH | SSRF via HTTP Redirect Following in Langflow API Request Component |
| CVE-2026-11594 | 8.5 HIGH | IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilit |
| CVE-2026-11714 | 8.5 HIGH | IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerabil |
| CVE-2026-10564 | 8.2 HIGH | SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection |
| CVE-2026-10560 | 8.2 HIGH | Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS |
| CVE-2025-36359 | 8.1 HIGH | IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability. |
| CVE-2026-13449 | 7.6 HIGH | XXE attack in IBM Business Automation Manager Open Editions |
| CVE-2026-13772 | 7.5 HIGH | IBM WebSphere eXtreme Scale's OQL is affected by remote code execution |
| CVE-2026-13759 | 7.5 HIGH | IBM WebSphere eXtreme Scale is affected by Insecure Deserilization |
| CVE-2026-11541 | 7.4 HIGH | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by |
| CVE-2026-11806 | 7.2 HIGH | IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerabi |
Showing top 20 of 43 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Langflow OSS
- CVE-2026-10129
SSRF via HTTP Redirect Following in Langflow API Request Com - CVE-2026-10134
Unauthenticated Server-Side RCE via PythonCodeStructuredTool - CVE-2026-10140
Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voi - CVE-2026-10546
DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow O - CVE-2026-10560
Unauthenticated Access to Private Flow Build Events and Canc
Same vendor: IBM
- CVE-2026-9074
IBM API Connect SQL Injection - CVE-2026-3144
IBM API Connect Default Credentials - CVE-2026-11541
IBM WebSphere Application Server and WebSphere Application S - CVE-2026-11594
IBM WebSphere Application Server is affected by multiple cro - CVE-2025-12530
Vulnerabilities found in Watson Data Intelligence
Same weakness: CWE-20
- CVE-2026-3576
Planyo online reservation system <= 3.0 - Unauthenticated Se - CVE-2026-15288
SureForms – Drag and Drop Form Builder for WordPress <= 2.2. - CVE-2026-0282
PAN-OS: File Deletion Vulnerability in Management Web Interf - CVE-2025-58146
XAPI UTF-8 string handling - CVE-2026-15122
Chrome<150.0.7871.115代码编解码器输入验证不足漏洞
V. Comments for CVE-2026-7803
No comments yet