CVE-2026-24055

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24055", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.778Z", "datePublished": "2026-01-22T03:07:03.784Z", "dateUpdated": "2026-01-22T12:40:42.009Z"}, "containers": {"cna": {"title": "Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x"}, {"name": "https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a", "tags": ["x_refsource_MISC"], "url": "https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a"}, {"name": "https://github.com/langfuse/langfuse/releases/tag/v3.147.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/langfuse/langfuse/releases/tag/v3.147.0"}, {"name": "https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrations", "tags": ["x_refsource_MISC"], "url": "https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrations"}], "affected": [{"vendor": "langfuse", "product": "langfuse", "versions": [{"version": ">= 3.89.0, < 3.147.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:07:03.784Z"}, "descriptions": [{"lang": "en", "value": "Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow, and the callback stores installations based on this untrusted metadata. This allows an attacker to bind their Slack workspace to any project and potentially receive changes to prompts stored in Langfuse Prompt Management. An attacker can replace existing Prompt Slack Automation integrations or pre-register a malicious one, though the latter requires an authenticated user to unknowingly configure it despite visible workspace and channel indicators in the UI. This issue has been fixed in version 3.147.0."}], "source": {"advisory": "GHSA-pvq7-vvfj-p98x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T12:40:28.745623Z", "id": "CVE-2026-24055", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:40:42.009Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24055", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T12:40:28.745623Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:40:37.715Z"}}], "cna": {"title": "Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking", "source": {"advisory": "GHSA-pvq7-vvfj-p98x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "langfuse", "product": "langfuse", "versions": [{"status": "affected", "version": ">= 3.89.0, < 3.147.0"}]}], "references": [{"url": "https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x", "name": "https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a", "name": "https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/langfuse/langfuse/releases/tag/v3.147.0", "name": "https://github.com/langfuse/langfuse/releases/tag/v3.147.0", "tags": ["x_refsource_MISC"]}, {"url": "https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrations", "name": "https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrations", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow, and the callback stores installations based on this untrusted metadata. This allows an attacker to bind their Slack workspace to any project and potentially receive changes to prompts stored in Langfuse Prompt Management. An attacker can replace existing Prompt Slack Automation integrations or pre-register a malicious one, though the latter requires an authenticated user to unknowingly configure it despite visible workspace and channel indicators in the UI. This issue has been fixed in version 3.147.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:07:03.784Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24055", "state": "PUBLISHED", "dateUpdated": "2026-01-22T12:40:42.009Z", "dateReserved": "2026-01-20T22:30:11.778Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T03:07:03.784Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "langfuse", "vendor": "langfuse", "versions": [{"status": "affected", "version": ">= 3.89.0, < 3.147.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:langfuse:langfuse:*:*:*:*:*:*:*:*", "matchCriteriaId": "1058C1A1-0AEA-4CF4-9E22-B05B57F96B1D", "versionEndExcluding": "3.147.0", "versionStartIncluding": "3.89.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow, and the callback stores installations based on this untrusted metadata. This allows an attacker to bind their Slack workspace to any project and potentially receive changes to prompts stored in Langfuse Prompt Management. An attacker can replace existing Prompt Slack Automation integrations or pre-register a malicious one, though the latter requires an authenticated user to unknowingly configure it despite visible workspace and channel indicators in the UI. This issue has been fixed in version 3.147.0."}, {"lang": "es", "value": "Langfuse es una plataforma de ingenier\u00eda de modelos de lenguaje grandes de c\u00f3digo abierto. En las versiones 3.146.0 e inferiores, el endpoint /api/public/slack/install inicia el OAuth de Slack utilizando un projectId proporcionado por el cliente sin autenticaci\u00f3n ni autorizaci\u00f3n. El projectId se conserva durante todo el flujo de OAuth, y la devoluci\u00f3n de llamada almacena las instalaciones bas\u00e1ndose en estos metadatos no confiables. Esto permite a un atacante vincular su espacio de trabajo de Slack a cualquier proyecto y potencialmente recibir cambios en las indicaciones (prompts) almacenadas en Langfuse Prompt Management. Un atacante puede reemplazar las integraciones existentes de Prompt Slack Automation o pre-registrar una maliciosa, aunque esto \u00faltimo requiere que un usuario autenticado la configure sin saberlo a pesar de los indicadores visibles del espacio de trabajo y del canal en la interfaz de usuario (UI). Este problema ha sido solucionado en la versi\u00f3n 3.147.0."}], "id": "CVE-2026-24055", "lastModified": "2026-06-17T10:22:31.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24055", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T12:40:28.745623Z", "version": "2.0.3"}}]}, "published": "2026-01-22T04:16:00.367", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/langfuse/langfuse/releases/tag/v3.147.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrations"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:54:57.796646+00:00", "value": {"mitigation_remediation": ["Upgrade to Langfuse v3.147.0 or later to apply the fix.", "If an upgrade cannot be performed immediately, block external access to the /api/public/slack/install endpoint using a firewall or reverse\u2011proxy rule until a patch is deployed.", "Add ownership checks before initiating Slack integration so that only authenticated users can request a project\u2019s Slack installation."], "summary": {"action": "Patch", "impact": "Project Authorization Failure"}, "threat_synthesis": {"affected_systems": "All releases of Langfuse up to and including version 3.146.0 are affected. The vulnerability exists in the /api/public/slack/install endpoint used by every deployment of these versions.", "description_and_impact": "The Langfuse platform exposes a public Slack installation endpoint that accepts a project identifier without requiring authentication. The endpoint begins an OAuth flow using the supplied projectId, preserves it throughout the exchange, and records the installation data under that project. This flaw allows an unauthenticated actor to link any Slack workspace to any Langfuse project, potentially exposing prompt updates or replacing existing prompt\u2011to\u2011Slack integrations. The weakness is a type of authorization bypass (CWE\u2011284) and insecure direct object reference (CWE\u2011862).", "risk_and_exploitability": "The vulnerability scores moderate with a CVSS base of 6.3 and an EPSS estimate of less than 1\u202f%, indicating very low current exploitation probability, but it is not listed in the CISA KEV catalog. An attacker can trigger the flaw by making an unauthenticated HTTP request to the public Slack install endpoint, which is typically reachable from any network that can reach the Langfuse instance. Successful exploitation would let the attacker associate their Slack workspace with an arbitrary project and receive or alter prompt data within that project. Because the exploit path requires only network access to the public API, the threat surface is broad, though the impact is limited to the affected project rather than the entire system."}}}}, "created": "2026-01-22T10:07:52.947385+00:00", "updated": "2026-04-18T04:00:08.418959+00:00", "vendors": ["langfuse", "langfuse$PRODUCT$langfuse"]}