Tools AI Risk Radar ai-incident-0165
Incident record
Langflow fixes weak protection for stored credentials
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- langflow
- Actor
- researcher
- CVE
- CVE-2026-9205
What happened
An attacker who obtained the server secret could reconstruct the key used to encrypt stored API credentials and database passwords. The disclosure explains how predictable key derivation weakened credential protection.
langflow: affected <= 1.10.0; fixed in 1.10.1. The date shown is the maintainer’s original disclosure date. Its advisory assigns 9.1 under CVSS 3.1.
Sources
- Primary disclosuregithub.com/langflow-ai/langflow/security/advisories/GHSA-jxw…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026