What is the CVSS score of EUVD-2026-53547?

EUVD-2026-53547 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by EUVD-2026-53547?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a cryptographic weakness in key generation that exposes all stored API keys, credentials, and third-party connection secrets to decryption by…. A patch is available.

How to fix or mitigate EUVD-2026-53547?

Within 24 hours, audit your infrastructure to identify all running instances of IBM Langflow OSS 1.0.0-1.10.3 and assess exposure scope. Within 7 days, apply the vendor-released patch to upgrade all affected Langflow deployments to the patched version and immediately rotate all API keys, credentials, and connection secrets that were previously encrypted and stored in the vulnerable system. Within 30 days, verify all external integrations authenticate correctly with the newly rotated credentials and conduct a post-patch security audit of database access logs to identify any unauthorized access during the vulnerability window.

IBM Langflow OSS EUVD-2026-53547

| CVE-2026-9205 CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-08-05 ibm

GHSA-9pw3-x84f-xcwf

IBM Information Disclosure Langflow Oss

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Recovering the weak key and matching ciphertext raises complexity (AC:H); high confidentiality/integrity loss over stored secrets but no direct availability impact (A:N), so slightly below IBM's 9.8.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 18:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 18:37 vuln.today

cvss_changed

Severity Changed

Aug 06, 2026 - 18:37 NVD

HIGH CRITICAL

CVSS changed

Aug 06, 2026 - 18:37 NVD

7.4 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 05, 2026 - 18:46 vuln.today

CVE Published

Aug 05, 2026 - 18:09 cve.org

HIGH 7.4

DescriptionNVD

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

AnalysisAI

Predictable Fernet encryption key generation in IBM Langflow OSS (versions 1.0.0 through 1.10.3) stems from the ensure_fernet_key() function deriving keys from a cryptographically weak source (CWE-338), letting an attacker reconstruct the symmetric key that protects stored secrets such as API keys, credentials, and connection variables. Because the key is guessable rather than random, an actor who can read Langflow's encrypted data store can decrypt it and, depending on how the key is reused, potentially forge or tamper with protected values. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Langflow instance or obtain encrypted store

Delivery

Predict weak Fernet key via ensure_fernet_key

Exploit

Decrypt stored API keys and credentials

Execution

Pivot into connected LLM/database/services

Impact

Data theft and lateral movement

Access

Reach Langflow instance or obtain encrypted store

Delivery

Predict weak Fernet key via ensure_fernet_key

Exploit

Decrypt stored API keys and credentials

Execution

Pivot into connected LLM/database/services

Impact

Data theft and lateral movement

Vulnerability AssessmentAI

Exploitation	The specific prerequisite is that the target instance runs the vulnerable ensure_fernet_key() key-derivation path in IBM Langflow OSS 1.0.0-1.10.3 and stores secrets encrypted under the resulting weak Fernet key. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a Langflow instance or obtain a copy of its encrypted secret store predicts the Fernet key produced by ensure_fernet_key() thanks to its weak entropy, then decrypts the stored API keys and credentials offline. With those recovered secrets, the attacker pivots into the connected LLM providers, databases, and third-party services, or tampers with encrypted values. …
Remediation	Upgrade to a fixed release of IBM Langflow OSS above 1.10.3 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7282648 (patch confirmed available per vendor; an exact fixed version number is not stated in the provided data, so confirm the target release in that advisory before deploying). … Detailed patch versions, workarounds, and compensating controls in full report.