Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-10140

Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM Langflow OSS

Default version status: unaffected

  • 1.0.0 to ≤ 1.10.0affected

References