EUVD-2026-40403
GHSA-p5v5-v74q-w38h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated low-priv network attacker (PR:L, AC:L); scope change as impact crosses to other tenants and upstream accounts; integrity high from billing/accountability corruption, confidentiality only low since cross-credential data exposure is plausible but unconfirmed.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.
AnalysisAI
Cross-tenant credential confusion in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user manipulate the voice-mode shared cache so that other tenants' requests are processed with the wrong upstream API credentials, causing billing and accountability to be misattributed across tenant boundaries. The flaw (CWE-639) requires only low-privilege authentication and is rated critical (CVSS 9.6) because a scope change extends the impact to other users and upstream services. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Langflow is an open-source, Python-based visual framework for building LLM and agent workflows, and its voice mode brokers requests to upstream AI/voice providers using per-tenant API credentials. The vulnerability stems from improper shared-state handling: API client objects that carry credential context are cached and reused across requests without being correctly partitioned per tenant. This maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where one user's influence over cache state determines which credentials another user's request runs under, instead of each request being bound to its own authenticated identity.
RemediationAI
Patch available per vendor advisory: consult IBM's advisory at https://www.ibm.com/support/pages/node/7278209 for the fixed release and upgrade Langflow OSS beyond the affected 1.0.0-1.10.0 range as instructed; no exact fixed version number was included in the provided data, so do not assume one. As compensating controls until patched, disable the voice mode feature to eliminate the vulnerable shared-client cache path entirely (trade-off: loss of voice functionality for all users); and if voice mode must remain enabled, isolate tenants by running separate Langflow instances or processes per tenant so cached API clients cannot cross tenant boundaries (trade-off: higher operational and resource overhead). Additionally, monitor upstream provider billing and usage logs for anomalous attribution as a detective control while remediation is pending.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today