EUVD-2026-53549
GHSA-8jj7-whc4-r6j5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary impact is confidentiality of stored secrets, so C:H; attacker needs access to ciphertext and a short-secret config (PR:L, AC:H); decrypted tokens give limited integrity impact (I:L), no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.
AnalysisAI
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic random (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
Technical ContextAI
Langflow is an open-source, low-code visual framework for building LLM/agent workflows; it stores integration credentials (third-party API keys, OAuth/auth tokens) encrypted at rest using Fernet (an AES-128-CBC + HMAC symmetric scheme from the Python cryptography library that requires a high-entropy 32-byte key). The root cause maps to CWE-327 (Use of a Broken or Risky Cryptographic Algorithm): rather than deriving the Fernet key from a cryptographically secure source (e.g. os.urandom/secrets) or a proper KDF, the code path for user secrets under 32 characters falls back to Python's random module. random implements the Mersenne Twister, a fast statistical PRNG that is fully deterministic and reversible given the seed and is explicitly documented as unsuitable for security or cryptographic use. The single affected CPE is cpe:2.3:a:ibm:langflow_oss.
RemediationAI
Patch available per vendor advisory: IBM has released a fix (see IBM support advisory https://www.ibm.com/support/pages/node/7282648) - upgrade Langflow OSS to the fixed release above 1.10.3 identified in that advisory (an exact fixed version is not stated in the provided data, so confirm the target version directly from the IBM advisory before upgrading). As an immediate compensating control until patched, configure the Langflow secret/encryption key to be a full-length, high-entropy value of 32 characters or more, which avoids the vulnerable short-secret code path that falls back to the random module; note this only prevents future weak-key generation and does not retroactively secure data already encrypted with a predictable key. Additionally, after upgrading, rotate and re-encrypt all stored secrets - regenerate the Langflow encryption key and re-enter/rotate the third-party API keys and authentication tokens that were previously stored, since any secret encrypted under a reproducible key must be treated as compromised. Restrict filesystem/database access to the Langflow secret store to limit who can obtain ciphertext, accepting the operational overhead of tighter access controls.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today