Langflow is affected by weaknesses in secret handling and sensitive configuration access (IBM Langflow OSS)
En bref
- Source
- NVD
- EPSS
- EPSS 0.11 % · centile 1 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ibm
- Statut NVD
- Analyzed
Rechercher sur…
Description
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.
Faiblesses (CWE)
- CWE-327 — Utilisation d'un algorithme cryptographique cassé ou risqué
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H | ibm |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-53549
- GCVE · GCVE-0-2026-8470
Configurations affectées (CPE NVD)
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*≥ 1.0.0 < 1.11.0
Produits affectés
| Produit | Versions |
|---|---|
| IBM · Langflow OSS | affected 1.0.0 ≤ 1.10.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |