CVE-2026-9205: Langflow Critical Vulnerability Due to Weak Fernet Key Derivation
Summary
CVE-2026-9205: Langflow: Weak Fernet Key via random.seed(). Affects langflow versions < 1.10.1. Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework designed for building applications that leverage large language models (LLMs). It allows users to manage API keys, secrets, and other sensitive information securely. However, a critical vulnerability has been identified in its handling of encryption keys, particularly when using the Python random module for key derivation.
Vulnerability Detail
Langflow utilizes Python's random module, which is a non-cryptographic pseudo-random number generator (PRNG), to derive the Fernet encryption key from the SECRET_KEY. If the SECRET_KEY is shorter than 32 characters, the derived key becomes deterministic and can be reproduced by anyone who knows the seed value. This allows an attacker who gains access to the SECRET_KEY to decrypt all user credentials stored in the database without the need for brute force. Even if the SECRET_KEY is 32 characters or longer, the raw key material is directly used as the Fernet key, making it vulnerable to exfiltration. The vulnerability is compounded by a path traversal issue that allows unauthorized access to the SECRET_KEY file, leading to a complete compromise of user credentials.
How To Fix
Latest published version: 1.14.0.dev2 as of 22 Oct 2026
pip install --upgrade "langflow==1.14.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.1
This is the first release that contains the fix.
pip install --upgrade "langflow==1.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your SECRET_KEY is at least 32 characters long and avoid using easily guessable secrets. However, this does not fully mitigate the risk associated with the vulnerability.
Conclusion
The vulnerability identified as CVE-2026-9205 in Langflow poses a significant risk to user credentials due to weak key derivation methods. It is crucial for users to update to the patched version 1.10.1 or later to mitigate this risk effectively.
See every vulnerability recorded for langflow →
FAQ
The vulnerability allows attackers to decrypt all stored user credentials if they gain access to the SECRET_KEY, leading to potential data breaches.
You can use Vulert's playground to check if your application is affected by this vulnerability without requiring any signup.
If immediate updating is not possible, consider implementing strong access controls and monitoring for any unauthorized access to your SECRET_KEY.
While using a long SECRET_KEY reduces the risk of deterministic key generation, it does not eliminate the vulnerability if the raw key is exposed.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
