CVE-2026-9205: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

CVE-2026-9205 · Severity: critical · CVSS 9.1 · Published 2026-08-05

Langflow, an open-source low-code platform for building AI applications, uses a weak method to encrypt stored credentials (API keys, LLM secrets, database passwords). When a deployment uses a short admin secret, an attacker who obtains that secret can instantly decrypt all stored credentials without brute force. Combined with a separate file-read vulnerability, an authenticated attacker can steal every user's credentials on a Langflow instance.

Technologies: Langflow, langflow (PyPI). Vendors: Langflow, PyPI.

Quick answers

Is CVE-2026-9205 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9205 being exploited in the wild.
How severe is CVE-2026-9205?
Critical severity, with a CVSS score of 9.1, published 5 August 2026.
Which products and versions are affected?
Langflow up to 1.10.0; langflow (PyPI) <= 1.10.0, ECOSYSTEM:introduced=0,fixed=1.10.1.
Is there a fix for CVE-2026-9205?
Yes. langflow (PyPI): upgrade to 1.10.1 or later. Until then: Ensure the SECRET_KEY is at least 32 characters long and generated using a cryptographically secure method; rotate all stored credentials (API keys, LLM secrets, database passwords) after upgrading to 1.10.1 if a short SECRET_KEY was previously used.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9205 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-9205?
Check whether you run Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langflow (PyPI): upgrade to 1.10.1 or later
    pip install "langflow>=1.10.1"

Ensure the SECRET_KEY is at least 32 characters long and generated using a cryptographically secure method; rotate all stored credentials (API keys, LLM secrets, database passwords) after upgrading to 1.10.1 if a short SECRET_KEY was previously used.</anigation> </invoke>

Technical details

The vulnerability is a double failure: (1) for SHORT secrets (&lt;32 chars), the code seeds Python's non-cryptographic Mersenne Twister PRNG and derives a deterministic Fernet key; (2) for LONG secrets, the raw secret itself becomes the Fernet key with only base64 padding. Both patterns allow trivial decryption given the SECRET_KEY file. The fix uses SHA-256-based KDF for short secrets and validates that new deployments generate 43-character random keys, while maintaining backward-compatible decryption via MultiFernet.

Affected products

  • Langflow Langflow up to 1.10.0

Identifiers

  • CVE-2026-9205
  • GHSA-jxw3-mjmx-3pqm
  • PYSEC-2026-4235

Timeline

  • 2026-10-05: disclosed
  • 2026-10-05: patched

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.