IBM Langflow CVE-2026-10140

Exploitation requires a valid authenticated account (PR:L) on a Langflow OSS instance running an affected version (1.0.0-1.10.0) with voice mode in use, and it specifically targets the voice-mode API-client caching path - it is not reachable through other Langflow features. The meaningful impact is realized only in multi-tenant or multi-user deployments where several users' requests share the same cache, so single-tenant or single-user installations face limited practical risk. Limiting factors: the attacker must already hold credentials, voice mode must be enabled and actively used by other tenants, and the deployment must share client state across those tenants for the misattribution to occur.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) reflects network reachability, low attack complexity, and only low privileges, with the scope change driving the critical score because impact lands on other tenants and upstream provider accounts. No EPSS score, KEV listing, or POC was provided, so quantitative exploitation likelihood is unknown; the absence of KEV and public exploit code indicates this is not known to be under active exploitation. Notably, the concrete impact described - billing and accountability misattribution - is primarily an integrity/accountability problem, so the C:H rating likely reflects potential cross-tenant data exposure when requests execute under another tenant's credentials rather than confirmed direct disclosure; this confidentiality weighting should be verified with IBM. Net assessment: a genuinely high-priority issue for any multi-tenant Langflow deployment since exploitation needs only a valid low-privilege account, but real-world urgency is tempered by the lack of evidence of in-the-wild use.

A low-privileged but authenticated user of a shared multi-tenant Langflow instance interacts with voice mode to seed or manipulate the shared API-client cache, then waits for or induces other tenants' voice requests to be served from that poisoned cache entry. Those victims' requests are executed using the attacker-influenced (incorrect) upstream API credentials, so usage is billed to and logged against the wrong tenant. No public proof-of-concept was provided.