CVE-2026-8470

HIGH

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-8470 has a selected CVSS score of 7.4 (high).

Description

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Langflow OSS

Browse IBM / Langflow OSS
CVE List1.0.0 to ≤ 1.10.3affected

References

2