VULNERABILITY INTELLIGENCE

CVE-2026-8470

CVSS score7.4 HIGH
EPSS probability0.11%
CISA KEVNot currently listed
Published2026-08-05
Last modified2026-10-24
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Description

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Weakness classification

  • CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Primary references