CVE-2026-9205 - Langflow is affected by weaknesses in secret handling and sensitive configuration access

Back Back to CVE browser

CRITICAL

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Published Aug 5, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.42%

Description

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.10.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Langflow OSS

n/a

Version	Status	Constraints
1.0.0	affected	<=1.10.3

Remediation

Vendor solution

IBM recommends upgrading to Langflow OSS 1.11.0 or newer https://github.com/langflow-ai/langflow/releases

Weaknesses (1)

CWE-338

References (1)

https://www.ibm.com/support/pages/node/7282648
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7282648		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Aug 5, 2026

Updated Aug 7, 2026

Reserved May 21, 2026

Link CVE-2026-9205

CISA Vulnrichment

Updated Aug 6, 2026

NVD

Status Analyzed

Modified Aug 7, 2026

Link CVE-2026-9205

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-9205