What is the CVSS score of CVE-2026-7874?

CVE-2026-7874 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Langflow Oss are affected by CVE-2026-7874?

IBM Langflow OSS versions 1.0.0-1.10.0 use inadequate encryption for stored credentials, enabling attackers with access to backend data to decrypt all API keys, database passwords, and third-party…. A patch is available.

How to fix or mitigate CVE-2026-7874?

Within 24 hours: Inventory all systems running IBM Langflow OSS versions 1.0.0-1.10.0 and isolate or restrict network access as needed. Within 7 days: Apply the vendor patch by upgrading to the patched version released by IBM. Within 30 days: Rotate all API keys, database credentials, and third-party service tokens previously managed by affected Langflow instances, and conduct audit logs for unauthorized access to integrated systems.

Langflow Oss CVE-2026-7874

EUVD-2026-40380 CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-06-30 ibm

GHSA-32fv-f5hq-fmx9

Information Disclosure IBM Langflow Oss

9.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 19:52 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.

AnalysisAI

Credential disclosure in IBM Langflow OSS versions 1.0.0 through 1.10.0 stems from a weak, reversible key-derivation mechanism used to protect secrets encrypted at rest, allowing an attacker who can reach the stored credential data to recover the encryption key and decrypt every stored credential. Because Langflow stores API keys, database connection strings, and third-party service tokens used by AI workflow components, recovery of these secrets gives an attacker the keys to all integrated systems. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied, so the threat is currently theoretical but high-impact, and IBM (the reporter) has released a fix.