CVE-2026-9205
CRITICAL
CVSS 9.8
langflow_oss
Verified Advisory
Weak PRNG in cryptographic key derivation in IBM Langflow OSS (CVE-2026-9205)
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function, classified under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). An unauthenticated remote attacker could exploit this weakness to achieve high impact on confidentiality and integrity of affected systems.
Affected versions:
- 1.0.0-1.10.3
We recommend updating to: 1.11.0.
CVSS 9.8 · our assessment: act_now
Reference: https://www.ibm.com/support/pages/node/7282648
Details: https://vuln.today/cve/CVE-2026-9205
Verified by vuln.today against published advisories.
Affected versions
- – 1.0.0-1.10.3
Fixed in: 1.11.0
More advisories for langflow_oss
- CVE-2026-8470 – Weak PRNG used for Fernet key generation in IBM Langflow OSS (CVE-2026-8470)
- CVE-2026-12946 – Remote code execution in IBM Langflow OSS CodeAgent component (CVE-2026-12946)
- CVE-2026-13435 – Python interpreter sandbox bypass in IBM Langflow OSS (CVE-2026-13435)
- CVE-2026-13446 – Hard-coded credentials in IBM Langflow OSS (CVE-2026-13446)
- CVE-2026-13445 – Insecure file path handling in IBM Langflow OSS (CVE-2026-13445)
- CVE-2026-13448 – Unauthenticated remote code execution in IBM Langflow (CVE-2026-13448)
- CVE-2026-14499 – OS command injection in IBM Langflow OSS Python Interpreter (CVE-2026-14499)
- CVE-2026-7667 – Path traversal in the API Request component of IBM Langflow OSS (CVE-2026-7667)