Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-7803
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 30, 2026
- Source last modified
- October 25, 2026
Description
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
Description quoted from the NVD record.
Who is affected
Langflow (also called IBM Langflow OSS) is a tool for building apps that use AI language models by connecting building blocks into workflows. This flaw affects versions 1.0.0 through 1.10.0. The problem is in how Langflow checks the building blocks in a workflow: it does not properly check blocks whose type is missing or left blank. Because of this, an attacker could run their own code on the computer or server where Langflow runs. This flaw is rated Critical.
What to do
- If someone in your organization installed or runs Langflow, that person should check which version is in use. Versions
1.0.0through1.10.0are affected. - No fixed version is named for this flaw yet, so that person should check the vendor advisory linked on this page for a fixed release.
- When a fixed release is available, install it as soon as possible.
- If an IT provider or vendor runs Langflow for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.