CVE-2026-10140: Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem

Synopsis

This is an improper shared-state handling vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0, specifically in the voice mode subsystem. An authenticated attacker can reach the affected service over the network and manipulate internal cache state to cause other tenants' requests to be processed under the wrong upstream API credentials. Successful exploitation gives the attacker the ability to fraudulently consume billing quota attributed to other tenants and break accountability tracing across tenant boundaries. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Langflow voice mode API endpoint over the network; the CVSS vector specifies AV:N, meaning any internet- or intranet-exposed deployment is in scope.

• AuthenticationRequired

  The attacker must hold a valid account with at least low-privilege access; the CVSS vector specifies PR:L, so a standard user account is sufficient and no administrative credentials are needed.

• Victim interactionNot required

  No action is required from any other user or administrator; the CVSS vector specifies UI:N, so the attacker can trigger cross-tenant cache manipulation entirely on their own.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors that must be precisely timed.

Blast Radius

• Reads upstream API credentials belonging to other tenants as those credentials are substituted into the attacker's request pipeline.
• Causes billable API usage (voice mode calls) to be charged to victim tenants rather than the attacker, enabling direct financial fraud.
• Breaks audit and accountability logs so that requests originating from one tenant are recorded under another tenant's identity.
• Integrity of billing records and usage attribution is corrupted across any tenant whose requests are processed through the manipulated cache entry.