CVE-2026-8470
CRITICAL
CVSS 9.1
langflow_oss
Verified Advisory
Weak PRNG used for Fernet key generation in IBM Langflow OSS (CVE-2026-8470)
IBM Langflow OSS uses Python's non-cryptographic `random` module (Mersenne Twister PRNG) to generate Fernet encryption keys when user secrets are shorter than 32 characters. Because the PRNG is deterministic, identical seeds produce identical keys, enabling an attacker to reproduce encryption keys and decrypt stored API keys and authentication tokens.
Affected versions:
- 1.0.0-1.10.3
We recommend updating to: 1.11.0.
CVSS 9.1 · our assessment: act_now
Reference: https://www.ibm.com/support/pages/node/7282648
Details: https://vuln.today/cve/CVE-2026-8470
Verified by vuln.today against published advisories.
Affected versions
- – 1.0.0-1.10.3
Fixed in: 1.11.0
More advisories for langflow_oss
- CVE-2026-9205 – Weak PRNG in cryptographic key derivation in IBM Langflow OSS (CVE-2026-9205)
- CVE-2026-12946 – Remote code execution in IBM Langflow OSS CodeAgent component (CVE-2026-12946)
- CVE-2026-13435 – Python interpreter sandbox bypass in IBM Langflow OSS (CVE-2026-13435)
- CVE-2026-13446 – Hard-coded credentials in IBM Langflow OSS (CVE-2026-13446)
- CVE-2026-13445 – Insecure file path handling in IBM Langflow OSS (CVE-2026-13445)
- CVE-2026-13448 – Unauthenticated remote code execution in IBM Langflow (CVE-2026-13448)
- CVE-2026-14499 – OS command injection in IBM Langflow OSS Python Interpreter (CVE-2026-14499)
- CVE-2026-7667 – Path traversal in the API Request component of IBM Langflow OSS (CVE-2026-7667)