IBMCVE-2026-9205

IBM Langflow OSS: weak cryptography

High7.4CVE-2026-9205 · Published Aug 5, 2026 · updated Aug 7, 2026

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

Affected versions

Package	Affected	Fixed in
Langflow OSS Product	>= 1.0.0, <= 1.10.3	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-338

More IBM advisories

Date	Advisory	Severity	Fixed in
Aug 5	IBM Langflow OSS: code injection High8.1Aug 5 CVE-2026-9196No fix yet	High8.1	No fix yet
Aug 5	IBM Langflow OSS: code execution High8.8Aug 5 CVE-2026-9201No fix yet	High8.8	No fix yet
Aug 5	IBM Langflow OSS: information disclosure High7.1Aug 5 CVE-2026-9130No fix yet	High7.1	No fix yet
Aug 5	IBM Langflow OSS: code injection High8.8Aug 5 CVE-2026-8478No fix yet	High8.8	No fix yet
Aug 5	IBM Langflow OSS: broken cryptography High7.4Aug 5 CVE-2026-8470No fix yet	High7.4	No fix yet
Aug 5	IBM Langflow OSS: path traversal Medium6.5Aug 5 CVE-2026-7658No fix yet	Medium6.5	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.