CVE-2026-7803: Langflow malformed flow nodes

CISO Take

IBM Langflow, an open-source low-code framework for building LLM and agent workflows, fails to properly validate flow nodes that have missing or empty component type fields, allowing an unauthenticated attacker to achieve arbitrary code execution on the host running the instance. This is a CVSS 9.8 critical: no privileges or user interaction are required, the attack is network-reachable, and successful exploitation gives full confidentiality, integrity, and availability compromise of whatever system runs the Langflow server — which in practice means the orchestration layer sitting on top of your LLM pipelines, credentials, and connected tools. There is currently no public exploit, no Nuclei template, and it is not in CISA KEV, and EPSS sits at 0.36% (though in the top 72nd percentile of scored CVEs), so mass exploitation has not yet materialized — but the low complexity and lack of any authentication barrier make this a prime target once a PoC surfaces. Patch to the version specified in IBM's advisory beyond 1.10.0 immediately, and in the interim do not expose Langflow instances directly to the internet; place them behind authentication and network controls, and monitor for flow-import API calls containing nodes with missing or empty `type` fields as a detection signal.

Sources: NVD EPSS CISA KEV ATLAS ibm.com

What is the risk?

Critical on paper (CVSS 9.8, AV:N/AC:L/PR:N/UI:N, full C/I/A impact) but not yet an emergency in practice: EPSS is low (0.36%), there's no CISA KEV listing, no public exploit code, and no Nuclei scanner template, indicating exploitation has not been observed in the wild as of this writing. However, the combination of zero authentication requirement, network reachability, and low attack complexity means the risk profile can shift rapidly the moment a working PoC is published — this is exactly the exploitability shape (unauthenticated, no interaction, trivial trigger) that tends to get weaponized fast once details circulate. Organizations running internet-facing or otherwise network-accessible Langflow instances should treat this as high-priority patching, not a wait-and-see item.

How does the attack unfold?

Initial Access

Attacker locates a network-reachable Langflow instance and submits a crafted flow definition via its API or import feature.

AML.T0049

Malformed Node Injection

The submitted flow contains one or more nodes with missing or empty component type fields that Langflow fails to validate.

Code Execution

The unvalidated node triggers arbitrary code execution in the context of the Langflow server process.

AML.T0050

Impact

Attacker gains full control of the host, exposing connected LLM API keys, vector DB credentials, and any tools reachable by the compromised AI pipeline.

Initial Access

Attacker locates a network-reachable Langflow instance and submits a crafted flow definition via its API or import feature.

AML.T0049

Malformed Node Injection

The submitted flow contains one or more nodes with missing or empty component type fields that Langflow fails to validate.

Code Execution

The unvalidated node triggers arbitrary code execution in the context of the Langflow server process.

AML.T0050

Impact

Attacker gains full control of the host, exposing connected LLM API keys, vector DB credentials, and any tools reachable by the compromised AI pipeline.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade Langflow past the affected 1.0.0–1.10.0 range to the version specified in IBM's advisory (https://www.ibm.com/support/pages/node/7278445) as soon as possible. Until patched, do not expose Langflow's API or UI directly to untrusted networks — restrict access via VPN, IP allowlisting, or an authenticating reverse proxy. Audit any flow-import or flow-creation endpoints for logging, and add detection rules that flag flow definitions submitted with nodes missing or containing empty type fields, which is the specific malformed-input pattern that triggers this vulnerability. Review recent flow imports/creations for anomalies if the instance has been externally reachable.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI system security

NIST AI RMF

MANAGE-4.1 - Monitor AI system risks and respond to incidents

Frequently Asked Questions

What is CVE-2026-7803?

IBM Langflow, an open-source low-code framework for building LLM and agent workflows, fails to properly validate flow nodes that have missing or empty component type fields, allowing an unauthenticated attacker to achieve arbitrary code execution on the host running the instance. This is a CVSS 9.8 critical: no privileges or user interaction are required, the attack is network-reachable, and successful exploitation gives full confidentiality, integrity, and availability compromise of whatever system runs the Langflow server — which in practice means the orchestration layer sitting on top of your LLM pipelines, credentials, and connected tools. There is currently no public exploit, no Nuclei template, and it is not in CISA KEV, and EPSS sits at 0.36% (though in the top 72nd percentile of scored CVEs), so mass exploitation has not yet materialized — but the low complexity and lack of any authentication barrier make this a prime target once a PoC surfaces. Patch to the version specified in IBM's advisory beyond 1.10.0 immediately, and in the interim do not expose Langflow instances directly to the internet; place them behind authentication and network controls, and monitor for flow-import API calls containing nodes with missing or empty `type` fields as a detection signal.

Is CVE-2026-7803 actively exploited?

No confirmed active exploitation of CVE-2026-7803 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7803?

Upgrade Langflow past the affected 1.0.0–1.10.0 range to the version specified in IBM's advisory (https://www.ibm.com/support/pages/node/7278445) as soon as possible. Until patched, do not expose Langflow's API or UI directly to untrusted networks — restrict access via VPN, IP allowlisting, or an authenticating reverse proxy. Audit any flow-import or flow-creation endpoints for logging, and add detection rules that flag flow definitions submitted with nodes missing or containing empty `type` fields, which is the specific malformed-input pattern that triggers this vulnerability. Review recent flow imports/creations for anomalies if the instance has been externally reachable.

What systems are affected by CVE-2026-7803?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration/framework, RAG pipelines.

What is the CVSS score for CVE-2026-7803?

CVE-2026-7803 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration/frameworkRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

Exploitation Scenario

An unauthenticated attacker identifies an internet-facing Langflow instance (e.g., via Shodan or a targeted scan) and submits a crafted flow definition — either through the API or an exposed import feature — containing one or more nodes with a missing or empty component type field. Langflow's node-processing logic fails to validate this field before acting on the node, and the attacker uses this gap to smuggle in code that executes in the context of the Langflow server process, granting a shell or equivalent remote code execution with no login, no user click, and no prior reconnaissance beyond finding the exposed endpoint. From there the attacker can harvest API keys and credentials configured in the flow environment, tamper with other flows, or pivot laterally into connected AI infrastructure.

Weaknesses (CWE)

CWE-20 Improper Input Validation Primary CWE-20 Improper Input Validation

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.