CVE-2026-7874 identifies a cryptographic weakness in IBM Langflow OSS versions 1.0.0 through 1.10.0. The product uses a weak and reversible key derivation mechanism based on a cryptographically weak PRNG for encrypting credentials at rest. This flaw can lead to the disclosure of all stored credentials, compromising confidentiality. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No official patch or remediation level is currently provided by IBM, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could result in full disclosure of all stored credentials within IBM Langflow OSS, leading to a critical breach of confidentiality and integrity. There is no impact on availability reported. The weakness allows attackers to potentially recover encryption keys due to the reversible and weak key derivation process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected versions and avoid storing sensitive credentials in affected installations. Monitor IBM advisories for updates on patches or mitigations.