# CVE-2026-9205: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

Source: https://junglewise.ai/threats/cve-2026-9205-langflow-weak-fernet-key-via-random-seed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-9205 · Severity: critical · CVSS 9.1 · Published 2026-08-05

Langflow, an open-source low-code platform for building AI applications, uses a weak method to encrypt stored credentials (API keys, LLM secrets, database passwords). When a deployment uses a short admin secret, an attacker who obtains that secret can instantly decrypt all stored credentials without brute force. Combined with a separate file-read vulnerability, an authenticated attacker can steal every user's credentials on a Langflow instance.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow), [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-9205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9205 being exploited in the wild.

**How severe is CVE-2026-9205?** Critical severity, with a CVSS score of 9.1, published 5 August 2026.

**Which products and versions are affected?** Langflow up to 1.10.0; langflow (PyPI) <= 1.10.0, ECOSYSTEM:introduced=0,fixed=1.10.1.

**Is there a fix for CVE-2026-9205?** Yes. langflow (PyPI): upgrade to 1.10.1 or later. Until then: Ensure the SECRET_KEY is at least 32 characters long and generated using a cryptographically secure method; rotate all stored credentials (API keys, LLM secrets, database passwords) after upgrading to 1.10.1 if a short SECRET_KEY was previously used.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9205 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9205?** Check whether you run Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.10.1 or later

  ```sh
  pip install "langflow>=1.10.1"
  ```


Ensure the SECRET_KEY is at least 32 characters long and generated using a cryptographically secure method; rotate all stored credentials (API keys, LLM secrets, database passwords) after upgrading to 1.10.1 if a short SECRET_KEY was previously used.</anigation>
</invoke>

## Technical details

The vulnerability is a double failure: (1) for SHORT secrets (&lt;32 chars), the code seeds Python's non-cryptographic Mersenne Twister PRNG and derives a deterministic Fernet key; (2) for LONG secrets, the raw secret itself becomes the Fernet key with only base64 padding. Both patterns allow trivial decryption given the SECRET_KEY file. The fix uses SHA-256-based KDF for short secrets and validates that new deployments generate 43-character random keys, while maintaining backward-compatible decryption via MultiFernet.

## Affected products

- Langflow Langflow up to 1.10.0

## Identifiers

- CVE-2026-9205
- GHSA-jxw3-mjmx-3pqm
- PYSEC-2026-4235

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)