Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-8470— Langflow is affected by weaknesses in secret handling and sensitive configuration access

Quick assessment

Affected

IBM Langflow OSS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

IBM Langflow OSS是美国IBM公司的一款可视化构建AI工作流的低代码工具平台。 IBM Langflow OSS 1.0.0版本至1.10.3版本存在加密问题漏洞，该漏洞源于使用Python非加密随机模块生成Fernet加密密钥，当用户秘密少于32字符时，确定性的Mersenne Twister PRNG对相同种子生成相同密钥，可能导致攻击者复现加密密钥并解密存储的API密钥和认证令牌。

CVSS 7.4 · High EPSS 0.11% · P1 Updated Aug 06, 2026

Possible ATT&CK Techniques 2 AI

T1530 · Data from Cloud Storage T1552.004 · Private Keys

Affected Version Matrix 1

Vendor	Product	Version Range	Status
IBM	Langflow OSS	`1.0.0≤ 1.10.3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-8470

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Source: CVE Program / CVE List V5

Vulnerability Description

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用已被攻破或存在风险的密码学算法

Source: CVE Program / CVE List V5

Vulnerability Title

IBM Langflow OSS 加密问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
IBM	Langflow OSS	1.0.0 ~ 1.10.3	`cpe:2.3:a:ibm:langflow_oss:1.0.0:::::::*`

II. Public POCs for CVE-2026-8470

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-8470

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-8470 (1)

🔗 Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access Read full article vendor-advisory patch

https://www.cve.org/CVERecord?id=CVE-2026-8470

Same Patch Batch · IBM · 2026-08-05 · 32 CVEs total

CVE-2026-8478	8.8 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-9201	8.8 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-17623	8.8 HIGH	Langflow is affected OS Command Injection in Model Context Protocol features
CVE-2026-17626	8.8 HIGH	Langflow is affected by security vulnerabilities in Model Context Protocol features
CVE-2026-17632	8.8 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-8182	8.8 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-17624	8.5 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-9077	8.5 HIGH	Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Proto
CVE-2026-17617	8.5 HIGH	Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator
CVE-2026-17633	8.5 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-10025	8.2 HIGH	IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
CVE-2026-9196	8.1 HIGH	Langflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-8400	8.1 HIGH	Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebS
CVE-2026-8183	7.7 HIGH	Langflow OSS is affected by arbitrary code execution in custom component validation and tr
CVE-2026-8446	7.5 HIGH	Langflow is affected by security vulnerabilities in Model Context Protocol features
CVE-2026-9205	7.4 HIGH	Langflow is affected by weaknesses in secret handling and sensitive configuration access
CVE-2026-17630	7.2 HIGH	Langflow is affected by security vulnerabilities in Model Context Protocol features
CVE-2026-17625	7.2 HIGH	Langflow is affected by OS Command Injection in Model Context Protocol features
CVE-2026-9081	7.1 HIGH	Langflow OSS is affected by server-side request forgery in provider validation and API req
CVE-2026-9130	7.1 HIGH	Langflow OSS is affected by arbitrary code execution in custom component validation and tr

Showing top 20 of 32 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Langflow OSS

Same vendor: IBM

Same weakness: CWE-327