CVE-2026-8470 carries a 9.1 CVSS critical rating, but the EPSS score of 0.00111 tells a different story — one you should take seriously when prioritizing remediation. The vulnerability stems from IBM Langflow using Python's non-cryptographic random module (Mersenne Twister) seeded with user secrets to derive Fernet keys that encrypt stored API keys and authentication tokens. The 9.1 rating assumes worst-case low-entropy input, but whether that worst-case actually occurs in production is the critical question you need to answer.
The exploitability of this flaw hinges entirely on the entropy of those 'user secrets.' If they are user-chosen passwords under 32 characters, the effective keyspace collapses to whatever password patterns users actually employ — far narrower than the cryptographic key length suggests. If they're system-generated tokens, entropy could be substantially higher, making seed reconstruction computationally infeasible. The CVSS vector doesn't capture this distinction. Your first action: investigate what Langflow deployments in your environment actually use as seeds. Check configuration files, onboarding flows, and documentation to determine whether user-provided secrets or system-generated tokens feed the key derivation. If it's the latter, the practical severity drops significantly.
The low EPSS score likely reflects what automated systems have already figured out: exploiting this requires either already knowing the seed (which means you've already compromised the secret through other means) or reconstructing it from observable outputs — a precondition that dramatically narrows the attacker population. The historical precedent from PHP rand() and Ruby SecureRandom vulnerabilities shows these attacks only succeed when the seed space is small enough to enumerate. If your deployment uses high-entropy secrets, the Mersenne Twister weakness becomes irrelevant.
Verify the affected versions (1.0.0 through 1.10.3) against your inventory. If you're running a newer version, confirm the patch actually replaced the random module with secrets or os.urandom rather than simply bumping version numbers — the fourfold repetition in the CVE description raises data quality concerns worth double-checking. Prioritize validating the seed source over rushing to patch; the exploitation chain may be more constrained than the CVSS score implies.