IBM Langflow Weak PRNG in Fernet Key Derivation Exposes Stored Secrets
First seen Aug 7, 2026 · Updated Aug 7, 2026 · CVSS 7.4
IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic Mersenne Twister PRNG to derive Fernet encryption keys from short user secrets, making key generation deterministic and predictable. An attacker who can predict or brute-force the seed can regenerate the encryption key and decrypt stored API keys and authentication tokens used by the agent platform.
Technical Analysis
Langflow encrypts sensitive credentials (API keys, auth tokens) at rest using Fernet symmetric encryption, but when the user-supplied secret is under 32 characters, the key derivation relies on Python's `random` module rather than a CSPRNG. Because Mersenne Twister is deterministic and its internal state can be inferred from limited outputs, an attacker who knows or guesses the seed/secret space can reproduce the exact Fernet key. This allows offline decryption of any secrets stored in Langflow's database or config store, including credentials used by connected LLM providers, tool integrations, and downstream agent workflows. The entry point is the credential storage/encryption subsystem rather than the agent's reasoning path, but the impact crosses into the broader agent supply chain since decrypted tokens can be reused to impersonate the agent or its tool connections.
Affected Systems
IBM Langflow OSS
Detection Signatures
- Log entries showing Fernet key generation calls sourced from Python `random` module rather than `secrets`/`os.urandom`
- Stored secrets shorter than 32 characters in Langflow configuration
- Unexpected decryption success of stored credentials outside normal application flow
- Anomalous access patterns to Langflow's secret/credential store from non-standard clients
Remediation Steps
- 1
Upgrade Langflow
Update to a patched Langflow release that uses a cryptographically secure random number generator (e.g., Python's `secrets` module or `os.urandom`) for Fernet key derivation.
- 2
Rotate all stored secrets
Assume all previously stored API keys, tokens, and credentials in affected Langflow instances are compromised; rotate them immediately after patching.
- 3
Enforce strong secret length
Require user secrets of 32+ characters and validate key derivation logic uses vetted cryptographic libraries.
- 4
Audit encryption implementation
Review custom cryptography code paths for use of non-cryptographic randomness and replace with standard, audited crypto primitives.
- 5
Restrict access to credential store
Limit network and filesystem access to Langflow's database/config storage to reduce exposure window for decrypted secrets.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.