CVE-2026-9205: Langflow derived its credential encryption key from random.seed()
Langflow 1.10.0 and earlier built the Fernet key that encrypts every stored credential (LLM API keys, database passwords) from Python's non-cryptographic random module seeded with SECRET_KEY. Anyone who gets the secret_key file can decrypt all of them offline.
What it is
When SECRET_KEY was shorter than 32 characters, _ensure_valid_key() called random.seed(SECRET_KEY) and took 32 bytes from the Mersenne Twister, so the encryption key was fully reproducible from the secret. Longer keys were used as the Fernet key directly.
Variables of type Credential, the default for OpenAI and Anthropic API keys saved through the Variables UI or API, are encrypted with this key.
The advisory points out that the secret_key file under /app/data/.cache/langflow/ can be read through a separate Langflow MCP path traversal bug, which makes the two a chain.
How to check
- Affected: langflow (pip) <= 1.10.0.
- Check how long your SECRET_KEY is and who could have read the secret_key file or a database backup.
How to fix
- Upgrade langflow to 1.10.1 or later.
- If your instance was exposed, rotate SECRET_KEY and every API key and password stored as a Langflow credential.
pip show langflow | grep Version