CVE-2026-8470: Langflow is affected by weaknesses in secret handling and sensitive configuration access
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8470?
CVE-2026-8470 has a risk score of 37, indicating a moderate vulnerability.
How do I fix CVE-2026-8470?
To fix CVE-2026-8470, ensure that you update IBM Langflow OSS to the latest version that addresses this vulnerability.
What software is affected by CVE-2026-8470?
CVE-2026-8470 affects IBM Langflow OSS, which utilizes Python's non-cryptographic features.
What are the implications of exploiting CVE-2026-8470?
Exploiting CVE-2026-8470 could lead to potential data compromise due to the use of non-cryptographic software.
When was CVE-2026-8470 published?
CVE-2026-8470 was published on August 5, 2026.