cveboard RSS feed

CVE-2026-9205

GitHubCritical, pip

Langflow: Weak Fernet Key via random.seed()

Langflow uses Python's random module (Mersenne Twister, a non-cryptographic PRNG) seeded with the SECRET_KEY to derive the Fernet encryption key for all stored user credentials (API keys, LLM provider secrets, database passwords).

No known exploitation
Severity
Critical, CVSS 9.1 (v3.1)
EPSS
0.3% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages