CVE-2026-24055
📋 TL;DR
This vulnerability allows unauthenticated attackers to bind their Slack workspace to any Langfuse project via the Slack OAuth endpoint. This could enable unauthorized access to prompt management changes and potentially replace existing Slack integrations. All Langfuse deployments running versions 3.146.0 or below are affected.
💻 Affected Systems
- Langfuse
📦 What is this software?
Langfuse by Langfuse
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains unauthorized access to sensitive prompt management data and replaces legitimate Slack integrations, potentially intercepting or manipulating AI prompt notifications.
Likely Case
Unauthorized Slack workspace binding to projects, potentially disrupting legitimate Slack automation workflows.
If Mitigated
Limited impact if proper network segmentation and monitoring are in place, though unauthorized access attempts may still occur.
🎯 Exploit Status
Exploitation requires basic understanding of OAuth flows but no authentication to Langfuse.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.147.0
Vendor Advisory: https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x
Restart Required: Yes
Instructions:
1. Update Langfuse to version 3.147.0 or higher. 2. Restart the Langfuse service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable Slack Integration Endpoint
allBlock access to the vulnerable /api/public/slack/install endpoint
# Add to web server config (nginx example):
location /api/public/slack/install { deny all; }
🧯 If You Can't Patch
- Implement network-level access controls to restrict access to the /api/public/slack/install endpoint
- Monitor logs for unauthorized access attempts to Slack OAuth endpoints
🔍 How to Verify
Check if Vulnerable:
Check Langfuse version via admin interface or API. If version ≤ 3.146.0, system is vulnerable.Check Version:
curl -s http://localhost:3000/api/public/health | grep versionVerify Fix Applied:
Confirm version is ≥ 3.147.0 and test that unauthorized projectId binding is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /api/public/slack/install
- OAuth callbacks with unexpected projectId values
Network Indicators:
- Unusual traffic patterns to Slack OAuth endpoints
- Multiple failed OAuth authorization attempts
SIEM Query:
source="langfuse" AND (url_path="/api/public/slack/install" OR message="Slack OAuth")🔗 References
- https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a
- https://github.com/langfuse/langfuse/releases/tag/v3.147.0
- https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x
- https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrations
