CVE-2026-10140CWE-639

CVE-2026-10140

Critical · published July 1, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-01T00:17Z
Affected products (1)
ProductVersionsFixed in
langflow/langflow≥ 1.0.0, ≤ 1.10.0—
References (1)
https://www.ibm.com/support/pages/node/7278209 · [email protected]
EPSS history
Timeline
  • 30 JUN 19:55Z
    Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem
    cvelistv5