PT-2026-53957 · Ibm · Langflow Oss

Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-10140

Mitre

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-10140

Produtos afetados

Langflow Oss

Referências · 2

• https://ibm.com/support/pages/node/7278209 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-10140 · Nota de Segurança