CVE-2026-9205 Details
Description
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.
A vulnerability exists in IBM Langflow OSS versions 1.0.0 prior to 1.10.3, related to weak cryptographic key derivation in the ensure_fernet_key() function. The application uses Python's non-cryptographic random module to generate Fernet encryption keys from user secrets shorter than 32 characters. This approach allows attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens, as the Mersenne Twister PRNG generates identical keys for the same seeds.
Users are advised to upgrade to IBM Langflow OSS version 1.11.0 or newer.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ibm.com/support/pages/node/7282648 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| langflow langflow | >= 1.0.0, < 1.11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |