CVE-2026-10140 CRITICAL

CVE-2026-10140: Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem

Vendor Ibm
Product Langflow OSS
Weakness CWE-639 · IDOR
Published June 30, 2026
Last update July 2, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

Key dates

02Disclosure timeline

June 30, 2026 CVE published
July 2, 2026 Record updated