CVE-2026-7874: IBM Langflow OSS: Weak Reversible Key Derivation Exposes Stored Credentials

Overview

IBM has published a vendor advisory covering CVE-2026-7874 in Langflow OSS. The record describes a weak and reversible key derivation mechanism used for encryption at rest, which could allow disclosure of all stored credentials. The vendor advisory is referenced in the record as IBM support page 7278447.

Impact

• The record states that all stored credentials could be disclosed.
• The CVSS 3.1 vector listed for this CVE is network-reachable, low complexity, requires no privileges and no user interaction, and has high confidentiality and integrity impact with no availability impact.
• Inference: because the weakness concerns protection of stored secrets, credentials kept by affected instances should be treated as at risk until the vendor's guidance is reviewed. The full downstream impact on connected systems is unknown.

Affected products and versions

• Product listed as Langflow Langflow (IBM Langflow OSS).
• Affected range listed as from 1.0.0 through 1.10.0, inclusive.
• The record lists no fixed version. This does not mean no fix exists; check the IBM advisory for remediation details.

Exploitation status

• The record indicates the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
• No confirmed exploitation appears in the sources consulted.
• The EPSS entry in the record (probability 0.00275, percentile 0.18455, dated 2026-10-13) is a statistical estimate of exploitation likelihood, not evidence of exploitation.

Remediation and mitigation

• Inventory Langflow OSS deployments and confirm whether any fall within the affected range.
• Monitor the IBM advisory for a fixed version and apply vendor guidance as soon as it is available.
• Inference: treat credentials stored by affected instances as potentially exposed. Rotate API keys, database passwords, tokens and third-party secrets, ideally after the vendor fix is applied, and prioritise high-value credentials.
• Restrict network exposure of Langflow instances and limit access to administrative interfaces and to the storage holding encrypted data and backups.
• Where practical, move secrets out of application storage into a dedicated secrets manager, which reduces the blast radius of any similar weakness.

Detection guidance

• Review access logs for unusual reads of the Langflow data store, configuration files or backups.
• Watch for unexpected use of credentials that were stored in Langflow, such as logins from unfamiliar sources or service calls outside normal patterns.
• Maintain an up-to-date inventory of instances and their versions so that exposure can be assessed quickly.

Limitations of the available information

• The record does not provide technical details of the key derivation weakness, and the CWE name is absent (only the identifier CWE-338 is listed).
• No fixed version is listed, and the record does not describe patches, workarounds or a timeline.
• The CVSS data comes from the IBM PSIRT entry in the record; independent confirmation was not available in the sources consulted.
• The record has no title, so the title in this analysis is derived from the description.

Frequently asked questions

Which Langflow OSS versions are affected by CVE-2026-7874?

The record lists IBM Langflow OSS from 1.0.0 through 1.10.0 as affected. Check the IBM advisory for the latest guidance on fixed versions.

Is CVE-2026-7874 known to be actively exploited?

The record indicates the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.