Flow Validation Bypass via Empty Component Type Field

Description

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

Affected Products

Vendor	Product	Versions
ibm	langflow oss	1.0.0

References

https://www.ibm.com/support/pages/node/7278445(vendor-advisory, patch)

Related News (1 articles)

Tier C

VulDB8d ago

CVE-2026-7803 | IBM Langflow OSS up to 1.10.0 input validation

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://www.ibm.com/support/pages/node/7278445

CWECWE-20

PublishedJun 30, 2026

Trending Score16

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-9074

IBM API Connect SQL Injection

Trending: 41

HIGHPRE-CVE

Multiple Vulnerabilities in IBM Operational Decision Manager Allow Code Execution, Privilege Escalation, DoS, Information Disclosure, File Manipulation, and Security Bypass

Trending: 27

HIGHCVE-2026-3144

IBM API Connect Default Credentials

Trending: 25

CRITICALCVE-2026-10109

IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling

Trending: 21

CRITICALCVE-2026-7663

Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass

Trending: 16

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jun 30, 2026

Discovered by ZDM

Jun 30, 2026

Patch Available

Jul 1, 2026