Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Langflow - #VU142384

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information and compromise the integrity of stored credentials.

The vulnerability exists due to weak prng-based cryptographic key derivation in the Fernet key derivation logic in src/backend/base/langflow/services/auth/service.py and src/backend/base/langflow/services/auth/utils.py when deriving the encryption key from the SECRET_KEY. A remote attacker can obtain the SECRET_KEY and encrypted credential data to decrypt stored credentials offline to disclose sensitive information and compromise the integrity of stored credentials.

All credential-type variables are encrypted under a shared instance-wide key, so a single exposed secret can affect credentials stored by all users on the instance.

Affected software

Remediation

External References

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-jxw3-mjmx-3pqm

Related Security Bulletins

• Multiple vulnerabilities in Langflow