GHSA-9pw3-x84f-xcwfHigh· 7.4▾ TwilightDuplicate Advisory: Langflow: Weak Fernet Key via random.seed()
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references.
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.
langflow <= 1.10.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9205Critical· 9.1Langflow: Weak Fernet Key via random.seed()
CVE-2026-27966Critical· 9.8Langflow has Remote Code Execution in CSV Agent
CVE-2026-7873Critical· 9.9Langflow: Code Injection Vulnerability in Code Validation Endpoint
GHSA-j8f7-x8jm-wmm4MediumLangflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assist…
CVE-2026-10561Critical· 9.9Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
GHSA-hhxr-7j22-694rLow· 6.3Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution