AIKIDO-2026-562769
langflow is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
91
Critical Risk
This Affects:
langflowTL;DR
Langflow derives the Fernet key for stored user credentials from SECRET_KEY. If that secret is shorter than 32 characters, it seeds Python's non-cryptographic Mersenne Twister PRNG and uses the generated bytes as the key; if it is longer, the raw value is used as the key with no key derivation. Anyone who obtains SECRET_KEY can regenerate the key and decrypt stored credentials offline, including model API keys, database passwords, OAuth tokens, and webhook secrets. The fix derives the key with SHA-256 hashing and adds MultiFernet backward compatible decryption so existing ciphertext still opens during migration.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and someone else can obtain your Langflow SECRET_KEY.
Background info
langflow is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in versions 1.1.2 - 1.10.0.
How to fix this
Upgrade the langflow library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.