What is GHSA-8jj7-whc4-r6j5?

GHSA-8jj7-whc4-r6j5 is a security advisory published by GitHub Security Advisories with High severity. IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0...

Which CVE IDs does GHSA-8jj7-whc4-r6j5 cover?

GHSA-8jj7-whc4-r6j5 covers the following CVE IDs: CVE-2026-8470. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8jj7-whc4-r6j5?

GHSA-8jj7-whc4-r6j5 has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

GHSA-8jj7-whc4-r6j5HighCVSS 7.4

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-8470 →

📋 Description

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-8470
https://www.ibm.com/support/pages/node/7282648
https://github.com/advisories/GHSA-8jj7-whc4-r6j5