CVE-2026-8470 is a weak cryptography flaw in Langflow OSS 1.0.0 through 1.10.3 (CVSS 7.4, high). Fernet keys built from short secrets came from a predictable random generator, so stored API keys could be decrypted. IBM recommends upgrading to 1.11.0 or newer. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
IBM lists Langflow OSS 1.0.0 through 1.10.3. The weakness is CWE-327, use of a broken or risky cryptographic algorithm. The record says Langflow used Python's non cryptographic random module to build Fernet keys from user secrets shorter than 32 characters.
Because the Mersenne Twister generator gives the same output for the same seed, an attacker who can reproduce the seed can reproduce the key. That could expose stored API keys and authentication tokens. IBM's fix is Langflow OSS 1.11.0 or newer, and the bulletin lists no workaround. The record is not in the CISA KEV catalog.
How to check if you're exposed
Find the installed version.
pip show langflow
langflow --version
If it is between 1.0.0 and 1.10.3, you are affected. Then ask a second question: is your Langflow secret key shorter than 32 characters? Short secrets are the ones the record names.
What to do now
- Upgrade Langflow OSS to 1.11.0 or newer.
- Check the length of the secret key your deployment uses, and set a long random value.
- Rotate API keys and tokens stored in Langflow, since encrypted values from the old scheme may be recoverable.
- Restrict who can read the Langflow database and backups.
- Review the IBM bulletin, which also mentions other secret handling weaknesses.
Why it matters
Fernet is sound. The weak step was how the key was made. A key is only as unpredictable as the source that produced it, and a general purpose random generator is built for speed and repeatability, not secrecy. Python provides the secrets module and os.urandom for this job.
Upgrading fixes future key generation, but it does not un-expose values that were already encrypted with weak keys. That is why rotation belongs in the plan.
Quick check
Is upgrading enough?
It fixes the code. Secrets that were already stored under a weak key should be rotated, because an attacker with a copy of the data could try to rebuild the key.
Sources
Last reviewed: 19 October 2026.
