CVE-2026-9205: Langflow weak Fernet key

CISO Take

IBM Langflow OSS derives the Fernet key that encrypts stored secrets—LLM provider API keys, database credentials, and other flow configuration data—through a cryptographically weak process (CWE-338), meaning that key may be predictable or reconstructable rather than truly random. Because the flaw is remotely reachable with no authentication or user interaction and carries full confidentiality, integrity, and availability impact (CVSS 9.8), a successful attacker could recover the encryption key and decrypt every credential Langflow has stored, then reuse those credentials against connected LLM APIs, vector databases, or internal systems. It is not yet in CISA KEV, has no public exploit code or Nuclei template, and CISA's SSVC decision is TRACK; EPSS sits at a low 0.23% but ranks in the 86th percentile of all scored CVEs, so it's more likely to be weaponized than most published CVEs but isn't under active exploitation yet. Patch any internet- or untrusted-network-reachable Langflow instance to the fixed release immediately, and treat this as a mandatory credential-rotation event—rotate every API key, database password, and token Langflow has encrypted, and monitor for anomalous use of those credentials against downstream AI/cloud services.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

Critical. The combination of network exploitability, no privileges or user interaction required, and full C/I/A impact makes this one of the more severe classes of AI-framework vulnerabilities: it doesn't just crash or leak the app itself, it undermines the confidentiality guarantee of every secret the platform was trusted to protect. Current exploitation likelihood is moderate-to-low in absolute terms (EPSS 0.23%, no KEV listing, no public PoC/scanner template, SSVC TRACK), which buys time but should not be read as low risk given the blast radius if a working exploit surfaces — weak key-derivation bugs are typically trivial to weaponize once the derivation logic is reverse-engineered from the patch diff.

How does the attack unfold?

Initial Access

Attacker locates a network-reachable Langflow instance and identifies it as running a version with the weak Fernet key derivation.

AML.T0049

Exploitation

Attacker reconstructs the predictable Fernet encryption key via the flawed ensure_fernet_key() logic without needing any credentials or user interaction.

Credential Theft

Using the derived key, the attacker decrypts Langflow's secret store, extracting LLM provider API keys, database credentials, and other stored secrets.

AML.T0055

Impact

Attacker reuses stolen credentials to abuse connected LLM/AI services, exfiltrate data, or pivot further into the victim's AI supply chain.

AML.T0025

Initial Access

Attacker locates a network-reachable Langflow instance and identifies it as running a version with the weak Fernet key derivation.

AML.T0049

Exploitation

Attacker reconstructs the predictable Fernet encryption key via the flawed ensure_fernet_key() logic without needing any credentials or user interaction.

Credential Theft

Using the derived key, the attacker decrypts Langflow's secret store, extracting LLM provider API keys, database credentials, and other stored secrets.

AML.T0055

Impact

Attacker reuses stolen credentials to abuse connected LLM/AI services, exfiltrate data, or pivot further into the victim's AI supply chain.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to the patched version referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7282648) as soon as it's validated in a test environment. 2) Treat all secrets previously encrypted by an affected instance as compromised: rotate every LLM provider API key, database credential, and webhook/token stored in Langflow flows. 3) Until patched, restrict network exposure of Langflow to trusted networks only (no public internet access) and place it behind authentication/VPN. 4) After patching, audit for signs of prior abuse — unexpected API usage/billing spikes on connected LLM providers, unfamiliar database connections, or anomalous flow executions. 5) Add Langflow to vulnerability/asset inventory tracking so future advisories for this package are caught automatically.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Framework API AML.T0010.001 - AI Software AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.4 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-9205?

IBM Langflow OSS derives the Fernet key that encrypts stored secrets—LLM provider API keys, database credentials, and other flow configuration data—through a cryptographically weak process (CWE-338), meaning that key may be predictable or reconstructable rather than truly random. Because the flaw is remotely reachable with no authentication or user interaction and carries full confidentiality, integrity, and availability impact (CVSS 9.8), a successful attacker could recover the encryption key and decrypt every credential Langflow has stored, then reuse those credentials against connected LLM APIs, vector databases, or internal systems. It is not yet in CISA KEV, has no public exploit code or Nuclei template, and CISA's SSVC decision is TRACK; EPSS sits at a low 0.23% but ranks in the 86th percentile of all scored CVEs, so it's more likely to be weaponized than most published CVEs but isn't under active exploitation yet. Patch any internet- or untrusted-network-reachable Langflow instance to the fixed release immediately, and treat this as a mandatory credential-rotation event—rotate every API key, database password, and token Langflow has encrypted, and monitor for anomalous use of those credentials against downstream AI/cloud services.

Is CVE-2026-9205 actively exploited?

No confirmed active exploitation of CVE-2026-9205 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9205?

1) Upgrade Langflow to the patched version referenced in IBM's advisory (https://www.ibm.com/support/pages/node/7282648) as soon as it's validated in a test environment. 2) Treat all secrets previously encrypted by an affected instance as compromised: rotate every LLM provider API key, database credential, and webhook/token stored in Langflow flows. 3) Until patched, restrict network exposure of Langflow to trusted networks only (no public internet access) and place it behind authentication/VPN. 4) After patching, audit for signs of prior abuse — unexpected API usage/billing spikes on connected LLM providers, unfamiliar database connections, or anomalous flow executions. 5) Add Langflow to vulnerability/asset inventory tracking so future advisories for this package are caught automatically.

What systems are affected by CVE-2026-9205?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration/workflow builders, credential/secrets management, RAG pipelines.

What is the CVSS score for CVE-2026-9205?

CVE-2026-9205 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration/workflow builderscredential/secrets managementRAG pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

Exploitation Scenario

An adversary scans for internet-facing Langflow instances (common in AI/ML dev and internal tooling deployments) and identifies a vulnerable, unpatched version. Rather than needing valid credentials, the attacker exploits the predictable ensure_fernet_key() derivation to reconstruct the instance's encryption key without any prior access or interaction from a legitimate user. With that key, the attacker decrypts the platform's secret store, extracting LLM provider API keys and database credentials embedded in saved flows. The attacker then uses those stolen credentials to rack up usage on the victim's LLM provider account, exfiltrate data from connected vector databases or internal systems, or pivot further into the victim's AI supply chain using the newly obtained access.

Weaknesses (CWE)

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Primary CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG): The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

[Implementation] Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.

Source: MITRE CWE corpus.