AI agent vulnerability · Langflow

GHSA-9pw3-x84f-xcwf: Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

highCVSS 3.1 7.4

This advisory was withdrawn on Oct 5, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references. Original Description IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey() function.

Published Aug 5, 2026 · Updated Oct 5, 2026

Affected packages

langflow

Ecosystem: PyPI
Affected: <= 1.10.0
Fixed in: No patched version yet
Check: pip show langflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references.

Original Description

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Langflow vulnerabilities

All Langflow entries