CVE-2026-7874: Langflow weak reversible KDF

CISO Take

Langflow, a widely used low-code framework for building LLM and agent workflows, encrypts credentials at rest — LLM API keys, database connection strings, vector-store tokens — using a key derivation mechanism that is weak and reversible, letting anyone who can reach the stored ciphertext recover every secret the instance holds. This matters because Langflow deployments routinely centralize the crown jewels of an AI stack in one place, so a single flaw here has organization-wide blast radius across every pipeline built on the platform, not just Langflow itself. There is no CISA KEV listing, no public PoC, and no Nuclei template yet, and EPSS sits at a modest 0.164% in absolute terms (though still in the top 94th percentile of scored CVEs) — so this isn't being mass-exploited today, but the 9.1 CVSS score reflects that a network-reachable actor needs no privileges or user interaction to fully compromise confidentiality once they can access the encrypted store. Teams running Langflow OSS 1.0.0–1.10.0 should upgrade immediately per IBM's advisory, rotate every credential ever stored in the affected instance, and audit access logs for prior unauthorized retrieval of encrypted credential data.

Sources: NVD EPSS IBM advisory (ibm.com) ATLAS

What is the risk?

CVSS 9.1 (critical) with AC:L, PR:N, UI:N reflects a low bar to exploitation once an attacker can reach the encrypted credential data — no authentication or user interaction needed to derive plaintext secrets. Availability impact is none (this is a pure confidentiality/integrity issue via CWE-338, weak/predictable cryptographic material), so the risk is entirely about mass credential disclosure rather than service disruption. Real-world exploitation likelihood is currently moderate-to-low: EPSS absolute probability is low (0.164%), it's not in CISA KEV, and no public exploit code or scanner signature exists yet. However, the severity-to-effort ratio is unusually favorable for attackers — reversing a weak KDF is a well-understood cryptographic exercise, not a novel research problem — so risk should be treated as high given the blast radius of a credential store that aggregates secrets across an entire AI pipeline.

How does the attack unfold?

Initial Access to Credential Store

Attacker obtains access to a Langflow instance's data — via an exposed deployment, leaked database backup, or exported flow/project file — that contains encrypted credential fields.

AML.T0084

Credential Extraction

Attacker pulls the encrypted credential blobs (LLM API keys, DB and vector-store connection strings) embedded in flow configurations or global variables.

AML.T0083

Weak Key Derivation Exploit

Because the encryption key is derived via a weak and reversible KDF (CWE-338), the attacker recomputes or reverses the key without needing an install-specific master secret.

AML.T0055

Credential Compromise and Lateral Use

Attacker decrypts all stored secrets and reuses them to access LLM provider accounts, databases, and vector stores, enabling data exfiltration, cost abuse, or further AI supply-chain compromise.

AML.T0012

Initial Access to Credential Store

Attacker obtains access to a Langflow instance's data — via an exposed deployment, leaked database backup, or exported flow/project file — that contains encrypted credential fields.

AML.T0084

Credential Extraction

Attacker pulls the encrypted credential blobs (LLM API keys, DB and vector-store connection strings) embedded in flow configurations or global variables.

AML.T0083

Weak Key Derivation Exploit

Because the encryption key is derived via a weak and reversible KDF (CWE-338), the attacker recomputes or reverses the key without needing an install-specific master secret.

AML.T0055

Credential Compromise and Lateral Use

Attacker decrypts all stored secrets and reuses them to access LLM provider accounts, databases, and vector stores, enabling data exfiltration, cost abuse, or further AI supply-chain compromise.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade Langflow to the patched version referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7278447) without delay. 2) Treat every credential ever stored in an affected instance as compromised — rotate all LLM API keys, database passwords, vector-store tokens, and third-party integration secrets configured in Langflow flows or global variables. 3) Restrict network and API access to the instance and its backups/exports until patched. 4) Audit access logs, API call history, and backup/export activity for signs prior credential retrieval occurred. 5) Going forward, verify that any self-hosted secrets-at-rest mechanism uses a strong, salted KDF (Argon2, scrypt, PBKDF2 with per-install randomness) rather than a static or reversible derivation, or move to envelope encryption backed by a proper KMS/secrets manager.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Auth Bypass Framework Agent API AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6.2 - Resources and security of AI system data

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-7874?

Langflow, a widely used low-code framework for building LLM and agent workflows, encrypts credentials at rest — LLM API keys, database connection strings, vector-store tokens — using a key derivation mechanism that is weak and reversible, letting anyone who can reach the stored ciphertext recover every secret the instance holds. This matters because Langflow deployments routinely centralize the crown jewels of an AI stack in one place, so a single flaw here has organization-wide blast radius across every pipeline built on the platform, not just Langflow itself. There is no CISA KEV listing, no public PoC, and no Nuclei template yet, and EPSS sits at a modest 0.164% in absolute terms (though still in the top 94th percentile of scored CVEs) — so this isn't being mass-exploited today, but the 9.1 CVSS score reflects that a network-reachable actor needs no privileges or user interaction to fully compromise confidentiality once they can access the encrypted store. Teams running Langflow OSS 1.0.0–1.10.0 should upgrade immediately per IBM's advisory, rotate every credential ever stored in the affected instance, and audit access logs for prior unauthorized retrieval of encrypted credential data.

Is CVE-2026-7874 actively exploited?

No confirmed active exploitation of CVE-2026-7874 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7874?

1) Upgrade Langflow to the patched version referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7278447) without delay. 2) Treat every credential ever stored in an affected instance as compromised — rotate all LLM API keys, database passwords, vector-store tokens, and third-party integration secrets configured in Langflow flows or global variables. 3) Restrict network and API access to the instance and its backups/exports until patched. 4) Audit access logs, API call history, and backup/export activity for signs prior credential retrieval occurred. 5) Going forward, verify that any self-hosted secrets-at-rest mechanism uses a strong, salted KDF (Argon2, scrypt, PBKDF2 with per-install randomness) rather than a static or reversible derivation, or move to envelope encryption backed by a proper KMS/secrets manager.

What systems are affected by CVE-2026-7874?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving/integration credential stores, LLM API key management.

What is the CVSS score for CVE-2026-7874?

CVE-2026-7874 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel serving/integration credential storesLLM API key management

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.

Exploitation Scenario

An attacker gains access to a Langflow instance's stored data — through an exposed/misconfigured deployment, a leaked database backup, or an exported flow/project file shared for collaboration or support. Rather than needing to authenticate or brute-force a strong key, they exploit the fact that the encryption key is derived via a weak, predictable KDF (CWE-338): the key can be recomputed or reversed without knowing an install-specific master secret. Using this, the attacker decrypts every stored credential in the flow definitions — LLM API keys, database passwords, vector database tokens — and pivots to consume paid LLM services at the victim's expense, exfiltrate data from connected databases and RAG vector stores, or poison downstream AI pipelines using the now-compromised service accounts.

Weaknesses (CWE)

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Primary CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG): The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

[Implementation] Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.

Source: MITRE CWE corpus.