What is CVE-2026-8470?

CVE-2026-8470 is a high-severity vulnerability in IBM Langflow Oss, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 7.4/10. Published 2026-08-05.

How severe is CVE-2026-8470?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in IBM Langflow Oss

CVE-2026-8470

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.001 (1.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Ibm Langflow Oss — versions 1.0.0
Langflow

Weakness classification (CWE)

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

References

psirt@us.ibm.com (vendor-advisory, patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-8470?: CVE-2026-8470 is a high-severity vulnerability in IBM Langflow Oss, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 7.4/10. Published 2026-08-05.
How severe is CVE-2026-8470?: High severity. CVSS v3 base score is 7.4 out of 10.