CVE-2026-10140

critical · 9.6

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

9.6

CVSS

0.4%

EPSS (exploit prob.)

29th

EPSS percentile

2026-06-30

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-639

Affected products

Vendor	Product	Affected versions
langflow	langflow	>= 1.0.0, <= 1.10.0

Check a specific version with /api/v1/cve/match.

References

https://www.ibm.com/support/pages/node/7278209

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-10140