CVE-2026-8470

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-847008.6PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when theCVE-2026-847015.4NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with CVE-2026-847027.5facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directoCVE-2026-847067.6A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates CVE-2026-847125.3A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ CVE-2026-847136.5A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ CVE-2026-847147.1A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular CVE-2026-847158.8FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated suCVE-2026-847166.6A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads CVE-2026-847175.3A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips CVE-2026-847184.3A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts thCVE-2026-847199.9A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sa