Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
Langflow may generate weak encryption key
published 3 months ago
Summary
The open‑source Langflow tool can create an encryption key that is easier to guess than it should be. This weak key could allow attackers to read or modify protected data. Update Langflow to the latest version or apply the recommended fix to ensure strong key generation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| PyPI | carlos coelho | langflow | <= 1.10.0 |
Original advisory text
Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references.
## Original Description
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.
This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references.
## Original Description
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Timeline
Published5 Aug 2026
Updated5 Oct 2026
First seen5 Oct 2026
Sources
GHSA-9pw3-x84f-xcwf · OSV
Track software like this
Free during beta