Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

GHSA-9pw3-x84f-xcwf

Published Aug 5, 2026 · Modified Oct 5, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references.

Original Description

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9205
WEB https://github.com/langflow-ai/langflow/pull/13704
WEB https://github.com/langflow-ai/langflow/commit/094694d3f20c1da499f4d8dbac15c510609e3026
WEB https://www.ibm.com/support/pages/node/7282648

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes