Langflow (>= 1.7.2, < 1.10.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/langflow--1.7.2--1.10.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 06 Oct 2026 00:44:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLangflow Insecure Credential Encryption and Key Derivationhttps://feed.craftedsignal.io/briefs/2026-10-langflow-weak-fernet/Tue, 06 Oct 2026 00:44:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-langflow-weak-fernet/Langflow versions 1.10.0 and earlier use a non-cryptographic PRNG to derive Fernet keys from short SECRET_KEYs, allowing unauthenticated attackers who obtain the secret key file to perform offline decryption of all stored user credentials.Langflow versions 1.10.0 and earlier contain a critical cryptographic vulnerability in the handling of Fernet encryption keys used for storing sensitive user credentials, such as LLM API keys and database passwords. The application's _ensure_valid_key function incorrectly utilizes Python's non-cryptographic random module (Mersenne Twister) seeded with the instance's SECRET_KEY when that key is shorter than 32 characters. Because this process is fully deterministic, an attacker who obtains the secret_key file can recreate the encryption key offline without brute force. Furthermore, even when the SECRET_KEY is 32 characters or longer, the application uses the raw key directly as the Fernet key. This flaw is particularly dangerous when paired with file-read vulnerabilities, such as the MCP path traversal, which allow unauthorized access to the secret_key file and the underlying SQLite database. Once these files are exfiltrated, an attacker can decrypt all stored Credential-type variables across the entire instance.

Attack Chain

  1. Attacker identifies a target Langflow instance (v1.10.0 or earlier).
  2. Attacker leverages an auxiliary vulnerability, such as MCP path traversal (GHSA-95rw-c7w3-xh7f), to bypass access controls.
  3. Attacker exfiltrates the configuration file located at /app/data/.cache/langflow/secret_key.
  4. Attacker exfiltrates the application database file langflow.db using the same file-read primitive.
  5. Attacker checks the length of the exfiltrated secret_key to determine if the PRNG branch or raw-key branch applies.
  6. Attacker executes an offline decryption script using the recovered secret_key and the extracted ciphertext from the variable table.
  7. Attacker successfully recovers all stored API keys, database passwords, and OAuth tokens for all users on the instance.

Impact

Successful exploitation allows for the complete compromise of all stored credentials on a Langflow instance. This includes sensitive third-party API keys (OpenAI, Anthropic), database connection strings, and webhook secrets. In multi-tenant environments, this vulnerability permits a single attacker with low-level privileges to exfiltrate every credential stored by every user on the platform. The decryption process is entirely offline, ensuring the attacker leaves no server-side log traces during the credential recovery phase.

Recommendation

  1. Upgrade Langflow to version 1.10.1 or later immediately to implement secure SHA-256 key derivation and mitigate the weak PRNG issue.
  2. Rotate all API keys, database passwords, and other credentials previously stored in any Langflow instance that was running an affected version.
  3. Inspect file access logs for unauthorized attempts to read the /app/data/.cache/langflow/ directory or the langflow.db file to identify potential prior exploitation.
  4. Ensure that the SECRET_KEY is set to a cryptographically secure random string of at least 32 characters to align with updated security requirements.
]]>criticaladvisorycredential-accessvulnerabilitylangflowremote-code-executioninjectionai-securitymcpconfiguration-writewebserveridordata-disclosure