CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.6. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-10140
Severity
CRITICAL
CVSS
9.6
EPSS
0.23%
Original NVD Description
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.
Related CVEs
Other vulnerabilities affecting the same vendor(s)