Skip to content
Threat Feed
Subscribe

Product

Langflow (>= 1.6.8, <= 1.9.0)

1 brief RSS
critical advisory

Langflow Insecure Credential Encryption and Key Derivation

Langflow versions 1.10.0 and earlier use a non-cryptographic PRNG to derive Fernet keys from short SECRET_KEYs, allowing unauthenticated attackers who obtain the secret key file to perform offline decryption of all stored user credentials.

Langflow +7 credential-access vulnerability remote-code-execution injection ai-security mcp configuration-write webserver +2
3r 6t 1c updated