External risk intelligence

IBM Langflow OSS API Client Reuse Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-10140

IBM Langflow is a workflow automation tool typically deployed as a web-based application or API service. As a web application platform, it is commonly exposed to the network to facilitate user access and service integration, making it a likely candidate for internet-facing deployment.

Langflow

1.0.0 to 1.10.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in IBM Langflow's voice mode related to how it handles shared states, potentially allowing one user to affect another's requests. This vulnerability could lead to incorrect billing or accountability if exploited, as API clients might be reused with the wrong credentials across different users.

Incorrect handling of shared states affects user requests.
Matters for accurate billing and user accountability.
Confirm relevance and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to IBM Langflow could potentially exploit a flaw in how the application manages shared states. By manipulating the cache, they might cause requests from one user to be processed using the API credentials of another. This could lead to incorrect billing and accountability issues across different users or tenants within the system.

Attacker needs prior authentication.
Vulnerability triggered by cache manipulation.
Risk of cross-tenant billing errors.

Live Threat

Current exploitation, exposure, and threat context

Improper shared-state handling in IBM Langflow OSS could allow an authenticated attacker to reuse API clients across tenant boundaries. This manipulation could cause requests from one user to be processed with another user's upstream API credentials, potentially leading to incorrect billing and accountability.

Tenant API clients could be misused.
API client reuse across tenants may occur.
Billing and accountability could be misattributed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects IBM Langflow OSS deployments. The first practical step is for platform or application teams to identify all instances of IBM Langflow OSS, confirm their network reachability and business criticality, and then locate the accountable owner for remediation planning.

Identify platform owners responsible for Langflow.
Verify network exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is a workflow automation tool used to build and manage data-driven applications. It functions as a web-based platform where users design logic flows, which often include voice mode capabilities for interactive services. Organizations typically deploy it as a centralized service to integrate various APIs and automate tasks, meaning it acts as a hub for processing data and managing external connections.

What does CWE-639 mean for CVE-2026-10140?

CWE-639 refers to an Authorization Bypass Through User-Controlled Key. In this CVE, it describes a flaw where the system incorrectly handles shared states. Because the application fails to properly isolate API clients, an attacker can manipulate the cache to swap identities, causing the system to treat one user's requests as if they were made by a different user. This breaks the expected boundary between tenants.

How is this vulnerability triggered?

An attacker must already have authenticated access to the application to initiate the flaw. The trigger involves manipulating the system's cache state to force the reuse of an API client across different tenant boundaries. Notably, this does not happen through standard usage; it requires specific, intentional manipulation of shared-state data to misdirect which credentials the system uses for a request.

Is my IBM Langflow instance at risk?

Halo Surface Signal indicates that IBM Langflow is frequently deployed as a web-facing application to support user access and service integrations, which often makes these instances internet-accessible. If your deployment is reachable via the network, it is more visible to potential attackers. You should evaluate your specific environment to determine if your instance is exposed to the internet or restricted to internal users.

What steps should I take to respond to this issue?

Begin by auditing your environment to locate all running instances of IBM Langflow OSS. Once identified, work with the team responsible for each instance to confirm its network accessibility and business purpose. Verify who the primary owner is for each deployment so you can coordinate with them to prioritize and plan the necessary remediation steps as they become available.

References

www.ibm.com/support/pages/node/7278209

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.