9.6
Critique
CVE-2026-10140 IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API…
Description
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Langflow OSS 1.0 | 1.0.0 → 1.10.0 | Pas de correctif indiqué |
Autres CVE de Langflow OSS
Les 176 CVE de Langflow OSS →
CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code…
6.5
Moyenne
CVE-2026-77817
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to…
6.5
Moyenne
CVE-2026-77819
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…
6.5
Moyenne
CVE-2026-90991
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…
6.5
Moyenne