CVE-2026-10140
Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem
CVSS Score
9.6
EPSS Score
0.0%
EPSS Percentile
0th
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.
| CWE | CWE-639 |
| Vendor | ibm |
| Product | langflow oss |
| Published | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm langflow oss
Be the first to know when new critical vulnerabilities affecting ibm langflow oss are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
IBM / Langflow OSS
1.0.0 ≤ 1.10.0