CVE-2026-8470
Langflow is affected by weaknesses in secret handling and sensitive configuration access
- State
- Published
- Severity
- 7.4 High
- Published
- Aug 5, 2026
- Updated
- Aug 5, 2026
- Reserved
- May 13, 2026
Description
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H | ibm |
Weaknesses
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected Products
| Product | Versions |
|---|---|
Langflow OSSIBM |
|
References
- https://www.ibm.com/support/pages/node/7282648vendor-advisorypatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.