CVE-2026-8470 — Langflow is affected by weaknesses in secret handling and sensitive configuration access

CVE-2026-8470

Langflow is affected by weaknesses in secret handling and sensitive configuration access PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.3

CWE

CWE-327

References

https://www.ibm.com/support/pages/node/7282648

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.