Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxw3-mjmx-3pqm. This link is maintained to preserve external references. Original Description IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

CVE-2026-9205 Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

PT-2026-68297

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS affected versions not specified Description An issue exists involving weak cryptographic key derivation within the ensure fernet key function. Key derivation is the process of deriving one or more secret keys from a master key...

CVE-2026-9205: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

Amazon Linux 2023 : perl-Crypt-PBKDF2 (ALAS2023-2026-1891)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1891 advisory. Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlyin...

CVE-2026-9641

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000...