CVE-2026-8470CWE-327

CVE-2026-8470

High · published August 5, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00111 · 1.2th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-08-05T23:17Z
Affected products (1)
ProductVersionsFixed in
langflow/langflow≥ 1.0.0, < 1.11.01.11.0
References (1)
https://www.ibm.com/support/pages/node/7282648 · [email protected]
EPSS history
Timeline
  • 05 AUG 18:11Z
    Langflow is affected by weaknesses in secret handling and sensitive configuration access
    cvelistv5