{"data":{"id":"85768b41-e61d-45c1-8860-2e5466e98c4b","title":"CVE-2026-10140: IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API…","summary":"CVE-2026-10140 affects IBM Langflow OSS versions 1.0.0 through 1.10.0 in voice mode. Improper shared-state handling allows reuse of API clients across tenant boundaries, so an authenticated attacker can manipulate cache state. Requests from other users may then be processed with incorrect upstream API credentials, causing cross-tenant billing and accountability misattribution. The weakness is classified as CWE-639, Authorization Bypass Through User-Controlled Key.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-10140","publishedAt":"2026-06-30T20:17:27.007Z","cveId":"CVE-2026-10140","cweIds":["CWE-639"],"cvssScore":"9.6","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS voice mode cross-tenant API client reuse","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0035,"epssCheckedAt":"2026-10-14T12:12:41.990Z","kevDateAdded":null,"advisoryAliases":["GHSA-p5v5-v74q-w38h"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:16.641Z","patchAvailable":null,"disclosureDate":"2026-06-30T20:17:27.007Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}