CVE-2026-10140: Langflow cross-tenant API

CISO Take

IBM Langflow's voice mode contains a shared-state bug that lets an authenticated user manipulate cache handling so their requests get processed using another tenant's upstream API credentials, and vice versa — turning a multi-tenant deployment into an unintended credential-sharing pool. The CVSS 9.6 rating and Scope:Changed vector reflect that a low-privileged authenticated user can breach tenant isolation with no user interaction required, producing both confidentiality and integrity impact: billing fraud, misattributed API usage, and potential exposure of one tenant's credentials/traffic to another. The EPSS score of just 0.2% and absence from CISA KEV indicate this isn't being mass-exploited today, and no public PoC or Nuclei template exists yet — but the flaw requires no novel research to trigger, only normal authenticated use of a shared feature, so the barrier to weaponization is low once attackers notice it. Any organization running multi-tenant Langflow (SaaS platforms, shared internal AI dev environments) should treat this as a priority patch rather than a monitor item, given the direct financial and accountability blast radius. Upgrade to a fixed IBM Langflow release beyond 1.10.0, and until patched, disable or isolate voice mode per tenant and audit upstream API billing logs for anomalous cross-account usage.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

Critical severity (CVSS 9.6) driven by high confidentiality and integrity impact with a changed scope — the flaw crosses a security boundary (tenant isolation) that Langflow is expected to enforce. Exploitability is high in principle: attack vector is network, complexity low, only low privileges required, and no user interaction needed, meaning any authenticated tenant user is a potential attacker or victim. However, real-world exploitation likelihood is currently low: EPSS sits at 0.2%, it is not in CISA KEV, and there is no public exploit or Nuclei scanner template. The net risk is therefore 'high potential impact, low current exploitation pressure' — a logic/architecture flaw rather than a classic memory-corruption bug, which means it is trivially reproducible by any legitimate multi-tenant user rather than requiring specialized exploit development, so risk should rise quickly if the bug becomes widely known.

How does the attack unfold?

Initial Access

An attacker with a valid, low-privileged account on a shared multi-tenant Langflow instance accesses the voice mode feature.

AML.T0012

State Manipulation

The attacker interacts with voice mode in a way that manipulates the improperly isolated shared cache, triggering reuse of another tenant's API client object.

AML.T0049

Credential Misattribution

Subsequent requests are processed using the wrong tenant's upstream API credentials, causing cross-tenant API calls to be billed or logged incorrectly.

AML.T0091.000

Impact

Victim tenants incur unexpected charges and lose accurate audit trails, breaking billing integrity and accountability across the platform.

AML.T0048.000

Initial Access

An attacker with a valid, low-privileged account on a shared multi-tenant Langflow instance accesses the voice mode feature.

AML.T0012

State Manipulation

The attacker interacts with voice mode in a way that manipulates the improperly isolated shared cache, triggering reuse of another tenant's API client object.

AML.T0049

Credential Misattribution

Subsequent requests are processed using the wrong tenant's upstream API credentials, causing cross-tenant API calls to be billed or logged incorrectly.

AML.T0091.000

Impact

Victim tenants incur unexpected charges and lose accurate audit trails, breaking billing integrity and accountability across the platform.

AML.T0048.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A None

What should I do?

1 step

1) Patch: upgrade IBM Langflow to the version that remediates this CVE (beyond 1.10.0) as soon as IBM publishes a fixed release — track https://www.ibm.com/support/pages/node/7278209 for the advisory update. 2) Workaround: disable voice mode in multi-tenant/shared deployments until patched, or run separate Langflow instances per tenant to eliminate shared cache state entirely. 3) Detection: audit upstream API provider billing/usage logs (LLM, STT/TTS providers) for usage patterns inconsistent with a tenant's own traffic volume or account, and review Langflow application logs for anomalous cache key collisions or client reuse across user sessions. 4) Hardening: enforce strict per-tenant credential scoping and cache key namespacing at the infrastructure layer (e.g., separate API client instances/processes per tenant) as defense-in-depth beyond the vendor patch.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Framework API AML.T0048.000 - Financial Harm AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.7 (Resources for AI systems) - Resource management and isolation for AI systems

NIST AI RMF

MANAGE-4.1 - Risks and benefits from third-party AI resources are monitored and managed

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-10140?

IBM Langflow's voice mode contains a shared-state bug that lets an authenticated user manipulate cache handling so their requests get processed using another tenant's upstream API credentials, and vice versa — turning a multi-tenant deployment into an unintended credential-sharing pool. The CVSS 9.6 rating and Scope:Changed vector reflect that a low-privileged authenticated user can breach tenant isolation with no user interaction required, producing both confidentiality and integrity impact: billing fraud, misattributed API usage, and potential exposure of one tenant's credentials/traffic to another. The EPSS score of just 0.2% and absence from CISA KEV indicate this isn't being mass-exploited today, and no public PoC or Nuclei template exists yet — but the flaw requires no novel research to trigger, only normal authenticated use of a shared feature, so the barrier to weaponization is low once attackers notice it. Any organization running multi-tenant Langflow (SaaS platforms, shared internal AI dev environments) should treat this as a priority patch rather than a monitor item, given the direct financial and accountability blast radius. Upgrade to a fixed IBM Langflow release beyond 1.10.0, and until patched, disable or isolate voice mode per tenant and audit upstream API billing logs for anomalous cross-account usage.

Is CVE-2026-10140 actively exploited?

No confirmed active exploitation of CVE-2026-10140 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-10140?

1) Patch: upgrade IBM Langflow to the version that remediates this CVE (beyond 1.10.0) as soon as IBM publishes a fixed release — track https://www.ibm.com/support/pages/node/7278209 for the advisory update. 2) Workaround: disable voice mode in multi-tenant/shared deployments until patched, or run separate Langflow instances per tenant to eliminate shared cache state entirely. 3) Detection: audit upstream API provider billing/usage logs (LLM, STT/TTS providers) for usage patterns inconsistent with a tenant's own traffic volume or account, and review Langflow application logs for anomalous cache key collisions or client reuse across user sessions. 4) Hardening: enforce strict per-tenant credential scoping and cache key namespacing at the infrastructure layer (e.g., separate API client instances/processes per tenant) as defense-in-depth beyond the vendor patch.

What systems are affected by CVE-2026-10140?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, multi-tenant SaaS deployments.

What is the CVSS score for CVE-2026-10140?

CVE-2026-10140 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingmulti-tenant SaaS deployments

MITRE ATLAS Techniques

AML.T0048.000 Financial Harm

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7 (Resources for AI systems)

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

Exploitation Scenario

A legitimate low-privileged user of a shared Langflow SaaS or internal multi-tenant instance interacts with voice mode in a way that manipulates the internal cache (e.g., rapid concurrent requests or specific session sequencing that triggers cache key collision). Due to the improper shared-state handling, the framework reuses an API client object tied to a different tenant's credentials for a subsequent request — either the attacker's request gets processed using another tenant's upstream API key (incurring cost and usage on the victim's account) or the attacker's own credentials get used to serve another tenant's request (creating an audit trail linking the attacker to unrelated activity). Repeated over time, this produces persistent billing misattribution and breaks the accountability chain needed for incident response, compliance audits, or usage-based billing disputes — with no need for the attacker to steal or brute-force any credentials directly.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.