CVE-2025-9799
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Langfuse's webhook handler. Attackers can manipulate the promptChangeEventSourcing function to make the server send unauthorized requests to internal systems. Organizations using Langfuse up to version 3.88.0 are affected.
💻 Affected Systems
- Langfuse
📦 What is this software?
Langfuse by Langfuse
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other systems within the network.
Likely Case
Limited data exposure from internal services accessible to the Langfuse server, potentially including metadata or configuration information.
If Mitigated
With proper network segmentation and egress filtering, impact is limited to services the Langfuse server can already access.
🎯 Exploit Status
Exploit details are publicly available but require specific conditions and knowledge of the target environment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.89.0 or later
Vendor Advisory: https://github.com/langfuse/langfuse/issues/8522
Restart Required: No
Instructions:
1. Update Langfuse to version 3.89.0 or later. 2. Verify the update completed successfully. 3. Test webhook functionality.
🔧 Temporary Workarounds
Restrict Webhook Access
allLimit access to the webhook endpoint using network controls or authentication.
Implement Egress Filtering
allRestrict outbound connections from the Langfuse server to only necessary destinations.
🧯 If You Can't Patch
- Isolate the Langfuse server in a restricted network segment with limited outbound access.
- Implement strict input validation and URL sanitization for webhook parameters.
🔍 How to Verify
Check if Vulnerable:
Check Langfuse version: if version <= 3.88.0, system is vulnerable.Check Version:
Check Langfuse dashboard or deployment configuration for version number.Verify Fix Applied:
Confirm Langfuse version is 3.89.0 or higher and test webhook functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Langfuse server to internal IPs
- Webhook requests with unusual URL parameters
Network Indicators:
- HTTP requests from Langfuse server to unexpected internal destinations
- Patterns of requests to metadata services (169.254.169.254, etc.)
SIEM Query:
source="langfuse" AND (dest_ip IN internal_range OR dest_ip=169.254.169.254)