{"data":{"id":"741ba8ec-e95a-4cf3-812e-14876bf07b89","title":"CVE-2026-8470: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use…","summary":"CVE-2026-8470 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. The product uses Python's non-cryptographic random module to generate Fernet encryption keys from user secrets shorter than 32 characters. Because the Mersenne Twister generator is deterministic, identical seeds produce identical keys, so an attacker can reproduce the keys and decrypt stored API keys and authentication tokens. The NVD has not yet provided an assessment, and the weakness is classified as CWE-327.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8470","publishedAt":"2026-08-05T19:17:44.823Z","cveId":"CVE-2026-8470","cweIds":["CWE-327"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS weak Fernet key generation from user secrets","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00111,"epssCheckedAt":"2026-11-09T18:09:51.972Z","kevDateAdded":null,"advisoryAliases":["GHSA-8jj7-whc4-r6j5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T12:10:52.071Z","patchAvailable":null,"disclosureDate":"2026-08-05T19:17:44.823Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-20"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}