{
 "id": "AIR-2026-1139",
 "slug": "cve-2026-10140-ibm-langflow-oss-voice-mode-shared-state-flaw",
 "title": "CVE-2026-10140: IBM Langflow OSS voice mode shared-state flaw leads to cross-tenant API client reuse",
 "summary": "Improper shared-state handling in IBM Langflow OSS versions 1.0.0 through 1.10.0 voice mode permits API client reuse across tenant boundaries. This flaw can cause requests to be processed using incorrect upstream credentials.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "IBM Langflow OSS"
 ],
 "incident_date": "2026-06-30",
 "incident_date_precision": "day",
 "first_reported": "2026-06-30",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10140",
   "publisher": "NVD",
   "title": "CVE-2026-10140: IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across…",
   "published_at": "2026-06-30"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-10140",
  "langflow",
  "tenant_isolation",
  "infra_vuln"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}