IBMCVE-2026-8470
IBM Langflow OSS: broken cryptography
High7.4CVE-2026-8470 · Published Aug 5, 2026 · updated Aug 6, 2026
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Langflow OSS Product | >= 1.0.0, <= 1.10.3 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-327
More IBM advisories
All IBM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 5 | IBM Langflow OSS: weak cryptography | High7.4 | No fix yet |
| Aug 5 | IBM Langflow OSS: code injection | High8.1 | No fix yet |
| Aug 5 | IBM Langflow OSS: code execution | High8.8 | No fix yet |
| Aug 5 | IBM Langflow OSS: information disclosure | High7.1 | No fix yet |
| Aug 5 | IBM Langflow OSS: code injection | High8.8 | No fix yet |
| Aug 5 | IBM Langflow OSS: path traversal | Medium6.5 | No fix yet |