Langflow flaw lets attackers decrypt stored API keys

A critical vulnerability in Langflow, the open-source tool for building AI workflows, allows attackers to decrypt all stored user credentials once they obtain the instance secret, according to a GitHub Security Advisory published on 5 October 2026 and tracked as CVE-2026-9205.

The flaw lies in how Langflow turns its SECRET_KEY into a Fernet encryption key, which protects stored credentials such as API keys, large language model provider secrets and database passwords. The advisory says Langflow uses Python's random module, a non-cryptographic random number generator, seeded with the SECRET_KEY to derive that encryption key. When the SECRET_KEY is shorter than 32 characters, the resulting key is fully deterministic and can be reproduced by anyone who knows the seed value, with no brute force required.

Even when the secret is 32 characters or longer, the advisory says the problem persists. In that case the raw key material is used directly as the Fernet key, so reading the secret_key file is enough to decrypt all credentials.

The advisory rates the issue critical, with a CVSS score of 9.1. It cites three weaknesses: use of a weak random number generator, a hard-coded cryptographic key and missing encryption of sensitive data.

According to the advisory, short secret keys are a common scenario for self-hosted deployments that use simple or memorable secrets. Everything stored as a credential type is encrypted under this key, which is the default for OpenAI and Anthropic API keys and any secret saved through the Variables interface or API.

The advisory describes a full attack chain when the flaw is combined with a separate path traversal vulnerability in Langflow's MCP feature. The secret_key file is stored at a fixed location that the advisory says is readable through that path traversal flaw. An attacker with only a low-privilege, authenticated account could read the secret, read the SQLite database file, and then decrypt credentials offline. The advisory states that no administrator access is needed.

Because all credentials are encrypted under the same instance-wide SECRET_KEY, the advisory says a single attacker account is enough to exfiltrate every credential stored by every user on the instance. In multi-tenant or enterprise deployments, that means one compromised account exposes all users' secrets.

The advisory includes a proof-of-concept script for both the short-key and long-key cases. It says the attack was confirmed on Langflow version 1.7.3, where two credential-type variables in the database were decrypted successfully. One was a sentinel test value stored through the API and then recovered from the raw database ciphertext using only the exfiltrated secret.

The advisory lists the issue as affecting OpenAI, Anthropic and other LLM provider API keys, as well as database connection strings, OAuth tokens and webhook secrets stored through the Variables interface. The structured incident record lists the status as reported. The advisory does not state that a fix has been released, and the record attributes the root cause to misconfiguration in how the key is handled.