CVE-2026-9205PATCHED

langflow · langflow

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Description

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

Affected Products

Vendor	Product	Versions
langflow	langflow	1.0.0

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
ibm	langflow	cert_advisory	90%

References

https://www.ibm.com/support/pages/node/7282648(vendor-advisory, patch)

Related News (2 articles)

Tier B

BSI Advisories17d ago

[NEU] [hoch] IBM Langflow Desktop: Mehrere Schwachstellen

→ No new info (linked only)

Tier C

VulDB18d ago

CVE-2026-9205 | IBM Langflow OSS up to 1.10.3 ensure_fernet_key risky encryption

→ No new info (linked only)

CVSS 3.17.4 HIGH

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://www.ibm.com/support/pages/node/7282648

CWECWE-338

PublishedAug 5, 2026

Trending Score6

Source articles2

Independent2

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-9198EXPKEV

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Trending: 21

HIGHCVE-2026-8478

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Trending: 6

HIGHCVE-2026-17632

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Trending: 6

HIGHCVE-2026-17633

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Trending: 6

HIGHCVE-2026-9201

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Trending: 6

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 5, 2026

Discovered by ZDM

Aug 5, 2026

Patch Available

Aug 7, 2026