The flaw resides in the ensure_fernet_key() function of IBM Langflow OSS, where a weak cryptographic key derivation mechanism produces predictable keys for Fernet encryption. When an attacker can influence the inputs to this derivation, the resulting encryption keys are vulnerable, allowing the attacker to decrypt or tamper with data protected by those keys, thereby compromising confidentiality and potentially integrity of sensitive information.

The vulnerable code is present in IBM Langflow OSS versions 1.0.0 and 1.10.3. The vendor recommends upgrading to version 1.11.0 or later to eliminate the weakness. Any deployment running the affected releases with the default secret handling routine is susceptible until the update is applied.

The CVSS score of 7.4 indicates a high severity, but the EPSS score is not available, so the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known active exploits yet. Based on the description, the likely attack vector is via the application’s secret generation workflow, which might be reachable by an attacker who can submit or influence configuration data.