{"data":{"id":"b209a5d1-dee3-46f1-a94c-03e46b2ed198","title":"CVE-2026-9205: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.","summary":"CVE-2026-9205 affects IBM Langflow OSS and concerns a weak cryptographic key derivation flaw in the ensure_fernet_key() function. The weakness is classified as CWE-338, use of a cryptographically weak pseudo-random number generator. NVD published the entry on 08/05/2026 and last modified it on 08/06/2026, and NVD has not yet provided its own assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9205","publishedAt":"2026-08-05T19:17:49.193Z","cveId":"CVE-2026-9205","cweIds":["CWE-338"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.10.0 (fixed: 1.10.1)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS weak key derivation in ensure_fernet_key()","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00302,"epssCheckedAt":"2026-11-10T00:11:22.478Z","kevDateAdded":null,"advisoryAliases":["GHSA-jxw3-mjmx-3pqm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:45:46.969Z","patchAvailable":true,"disclosureDate":"2026-08-05T19:17:49.193Z","fixReleasedAt":"2026-06-23T23:49:18.870Z","daysToFix":-43,"fixCheckedAt":"2026-10-29T21:32:07.116Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.10.1","matchedVersion":"1.10.1","fixReleasedAt":"2026-06-23T23:49:18.870Z","daysToFix":-43,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:06.970Z"}]}}