CVE-2026-8470 HIGH

CVE-2026-8470: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Vendor Ibm
Product Langflow OSS
Weakness CWE-327 · Broken crypto
Published August 5, 2026
Last update August 5, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Key dates

02Disclosure timeline

August 5, 2026 CVE published
August 5, 2026 Record updated