CVE-2026-24055

MEDIUM

Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-24055 has a selected CVSS score of 6.3 (medium); EIP currently links 1 repository PoC and 2 lab environments.

Description

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow, and the callback stores installations based on this untrusted metadata. This allows an attacker to bind their Slack workspace to any project and potentially receive changes to prompts stored in Langfuse Prompt Management. An attacker can replace existing Prompt Slack Automation integrations or pre-register a malicious one, though the latter requires an authenticated user to unknowingly configure it despite visible workspace and channel indicators in the UI. This issue has been fixed in version 3.147.0.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
2

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 22, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

langfuse

Browse langfuse / langfuse
CVE List>= 3.89.0, < 3.147.0affected

Proofs of concept

1

Repository PoCs

GitHubimzanggg/CVE-2026-24055-OAuth-LangfuseRepository PoCby imzanggg0Writeup6 files

154.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Vietnamese-language technical writeup and reproduction guide for payload withheld, an improper access control vulnerability in Langfuse's Slack OAuth installation endpoint. The document describes the vulnerability, provides step-by-step instructions for setting up a Docker environment to reproduce the exploit against a vulnerable version (3.146.0), and verifies the fix in a patched version (3.147.0). It contains no exploit or scanner code; the artifact is a README file with documentation and configuration instructions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a README.md documentation file describing a proof-of-concept for payload withheld. It contains no executable code, no concealed payloads, and no instructions for the reviewer to perform harmful actions. The document explains how to set up a vulnerable Langfuse instance and demonstrates the exploit, which is consistent with the published CVE. No backdoor or deceptive behavior is present.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesVietnamese
Target softwareLangfuse
Attack typesImproper Access Control
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical analysis, reproduction steps, and verification instructions for payload withheld. It does not contain any executable exploit or scanner code; it is a documentation writeup.

README.md:1-230

Requirements

  • Docker and Docker Compose must be installed to run the vulnerable and patched environments.README.md:55-60
  • A Slack App with a configured Redirect URL (http://localhost:3000) and its Client ID and Client Secret are required.README.md:66-76
  • The attacker must know the victim's projectId.README.md:37

Observed behavior

  • The document describes an unauthenticated attacker accessing the /api/public/slack/install endpoint with a victim's projectId to bind their Slack workspace to the victim's project.README.md:125-134
  • The document describes verifying the fix by showing that the same request to the patched version returns an HTTP 401 (unauthenticated) or 403 (forbidden) error.README.md:169-193
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation Only
Payload withheldThe file describes a PoC for payload withheld, including setup and exploitation steps, but contains no code that could be executed by the reviewer.README.md:1-230
Cve Reference
Payload withheldThe document references a known CVE and provides reproduction steps consistent with the advisory.README.md:35-45
Review boundaries

What the analysis did not establish

  • Only the README.md file was provided as text evidence. The repository contains 5 other files (including docker-compose.yml and .env.example files) that were not included in the text analysis, which could contain scanner or exploit code.
  • The analysis is based solely on the supplied text; no code was executed, and the described behavior is not verified.
  • Only the README.md file was provided as text; 4 other text files and 1 non-text file (assets/attack-sequence.png) were omitted from the evidence. Their content is unknown, but the analysis scope indicates no executable source code was identified in the repository.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

vulnerable/docker-compose.yml

imzanggg/CVE-2026-24055-OAuth-LangfuseCreated Vuln labCVE-2026-24055Compose · images

1 Compose manifest · 6 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for Langfuse v3.146.0, consisting of six services: langfuse-web, langfuse-worker, postgres, clickhouse, minio, and redis. The README describes it as a vulnerable reproduction environment for CVE-2026-24055, an unauthenticated Slack OAuth install vulnerability.

vulnerable/docker-compose.yml:1-178README.md:1-230

Lab assessment

Vulnerability lab

The README explicitly states the project reproduces CVE-2026-24055, a real-world vulnerability, and provides step-by-step exploitation instructions. The Compose file pins Langfuse images to the vulnerable version 3.146.0.

README.md:1-5README.md:7-12vulnerable/docker-compose.yml:9-10vulnerable/docker-compose.yml:72-73
Lab shapeCompose · images
Services6
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

langfuse-web

web applicationvulnerable target

Langfuse web frontend, exposed on host port 3000. Contains the vulnerable /api/public/slack/install endpoint. Depends on postgres, minio, redis, and clickhouse.

vulnerable/docker-compose.yml:72-100

langfuse-worker

background worker

Langfuse background worker, bound to localhost port 3030. Shares environment configuration with langfuse-web.

vulnerable/docker-compose.yml:9-70

postgres

database

PostgreSQL database, bound to localhost port 5432. Stores Langfuse application data.

vulnerable/docker-compose.yml:155-175

clickhouse

analytics database

ClickHouse database, bound to localhost ports 8123 and 9000. Used for analytics and event storage.

vulnerable/docker-compose.yml:102-121

minio

object storage

MinIO S3-compatible object storage, exposed on host port 9090 (API) and bound to localhost port 9091 (console). Creates a 'langfuse' bucket on startup.

vulnerable/docker-compose.yml:123-141

redis

cache / message broker

Redis instance, bound to localhost port 6379, with password authentication.

vulnerable/docker-compose.yml:143-153
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-24055

Supported by supplied evidence

The README explicitly associates the environment with CVE-2026-24055, describes the vulnerability as an unauthenticated Slack OAuth install, and provides reproduction steps. The Compose file uses Langfuse v3.146.0, which falls within the affected version range (3.89.0–3.146.0) stated in the README.

README.md:1-5README.md:37-41vulnerable/docker-compose.yml:9-10vulnerable/docker-compose.yml:72-73
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Desktop 24.0+ and Docker Compose v2README.md:55-59
  • A Slack App with Client ID and Client Secret, and http://localhost:3000 configured as a Redirect URLREADME.md:63-74
  • Environment variables set in .env file: NEXTAUTH_URL, SLACK_CLIENT_ID, SLACK_CLIENT_SECRET, SLACK_STATE_SECRETREADME.md:80-88

Evidence-described exercise path

  1. Configure environment: copy .env.example to .env and fill in Slack credentialsREADME.md:80-88
  2. Start the vulnerable environment with 'docker compose up -d'README.md:90-92
  3. Create a victim account and project, note the Project IDREADME.md:98-103
  4. As an unauthenticated attacker, visit http://localhost:3000/api/public/slack/install?projectId=<victim-project-id> to bind attacker's Slack workspace to victim's projectREADME.md:105-115
  5. Verify data leakage: victim creates a Slack automation and observes prompt metadata sent to attacker's Slack workspaceREADME.md:117-127
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (Langfuse v3.146.0) to demonstrate CVE-2026-24055. Port mappings bind most services to localhost, and the only externally exposed ports (3000 for web, 9090 for MinIO) are consistent with the documented lab requirements. No evidence of host escape, persistence, credential theft, or external communication beyond the intended Slack OAuth flow.

vulnerable/docker-compose.yml:1-178README.md:1-230
Review boundaries

What the analysis did not establish

  • The packet includes only the vulnerable Compose file and README; the patched Compose file and .env.example are referenced but not included in evidence_files.
  • No Dockerfiles or application source code are present, so internal application logic cannot be inspected.
  • The README is in Vietnamese; translation is based on the provided English summary and may miss nuances.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

patched/docker-compose.yml

imzanggg/CVE-2026-24055-OAuth-LangfuseCreated Vuln labCVE-2026-24055Compose · images

1 Compose manifest · 6 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for the patched version (3.147.0) of Langfuse, a LLM observability platform. It includes Langfuse web and worker services, along with supporting services: ClickHouse, MinIO, Redis, and PostgreSQL. The environment is part of a CVE-2026-24055 reproduction project, intended to verify that the vulnerability is fixed in this version.

patched/docker-compose.yml:1-178README.md:1-230

Lab assessment

Vulnerability lab

The README explicitly states the project reproduces CVE-2026-24055, an improper access control vulnerability in Langfuse. The patched directory contains a Docker Compose file for Langfuse v3.147.0, which is the fixed version. The README provides steps to verify the patch by attempting the exploit and expecting 401/403 errors, confirming the environment is designed for vulnerability research and verification.

README.md:1-4README.md:5-12README.md:33-37README.md:38-42README.md:43-47README.md:48-52README.md:53-57README.md:58-62README.md:63-67README.md:68-72README.md:73-77README.md:78-82README.md:83-87README.md:88-92README.md:93-97README.md:98-102README.md:103-107README.md:108-112README.md:113-117README.md:118-122README.md:123-127README.md:128-132README.md:133-137README.md:138-142README.md:143-147README.md:148-152README.md:153-157README.md:158-162README.md:163-167README.md:168-172README.md:173-177README.md:178-182README.md:183-187README.md:188-192README.md:193-197README.md:198-202README.md:203-207README.md:208-212README.md:213-217README.md:218-222README.md:223-227README.md:228-230
Lab shapeCompose · images
Services6
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

langfuse-web

web applicationOAuth endpoint host

Serves the Langfuse web UI on port 3000, exposed to the host. It includes the patched /api/public/slack/install endpoint that now requires authentication. Depends on postgres, minio, redis, and clickhouse.

patched/docker-compose.yml:78-107

langfuse-worker

background worker

Handles asynchronous tasks for Langfuse. Binds port 3030 to localhost only. Shares most environment variables with langfuse-web.

patched/docker-compose.yml:8-77

clickhouse

analytics database

ClickHouse database for Langfuse analytics. Binds ports 8123 and 9000 to localhost only. Uses named volumes for data and logs.

patched/docker-compose.yml:108-127

minio

object storage

MinIO S3-compatible storage. Exposes port 9090 to the host for API access and binds console port 9001 to localhost. Creates the 'langfuse' bucket on startup.

patched/docker-compose.yml:128-148

redis

cache / message broker

Redis 7 with password authentication. Binds port 6379 to localhost only.

patched/docker-compose.yml:149-162

postgres

relational database

PostgreSQL database for Langfuse. Binds port 5432 to localhost only. Uses a named volume for data persistence.

patched/docker-compose.yml:163-178
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-24055

Supported by supplied evidence

The README describes CVE-2026-24055 as an improper access control vulnerability in Langfuse versions 3.89.0 to 3.146.0, where the /api/public/slack/install endpoint lacks authentication. The patched docker-compose.yml uses Langfuse images tagged 3.147.0, which is the fixed version. The README provides verification steps expecting 401/403 responses, confirming the patch addresses the CVE.

README.md:33-37README.md:38-42README.md:43-47README.md:48-52README.md:53-57README.md:58-62README.md:63-67README.md:68-72README.md:73-77README.md:78-82README.md:83-87README.md:88-92README.md:93-97README.md:98-102README.md:103-107README.md:108-112README.md:113-117README.md:118-122README.md:123-127README.md:128-132README.md:133-137README.md:138-142README.md:143-147README.md:148-152README.md:153-157README.md:158-162README.md:163-167README.md:168-172README.md:173-177README.md:178-182README.md:183-187README.md:188-192README.md:193-197README.md:198-202README.md:203-207README.md:208-212README.md:213-217README.md:218-222README.md:223-227README.md:228-230
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Desktop 24.0+ and Docker Compose v2README.md:58-62
  • A Slack App with Client ID and Secret, and redirect URL http://localhost:3000README.md:68-77
  • Environment variables set in .env file (SLACK_CLIENT_ID, SLACK_CLIENT_SECRET, etc.)README.md:83-92
  • A victim project ID obtained from the Langfuse web UIREADME.md:98-102

Evidence-described exercise path

  1. Start the patched Langfuse environment with docker compose up -dREADME.md:148-152
  2. Attempt to access the Slack install endpoint without authentication; expect HTTP 401README.md:153-162
  3. Attempt to access the endpoint authenticated as a different user with a victim's projectId; expect HTTP 403README.md:163-172
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained Docker Compose lab for verifying a patch. All services bind to localhost except langfuse-web (port 3000) and minio (port 9090), which is a documented requirement for the lab. No privileged mode, host volume mounts, or external network calls are configured. The exercise path only involves HTTP requests to the local lab to confirm the vulnerability is fixed. No hidden, destructive, or host-escaping behavior is visible.

patched/docker-compose.yml:1-178README.md:1-230
Review boundaries

What the analysis did not establish

  • Only the patched docker-compose.yml is provided; the vulnerable version's compose file is not included in this packet, so a direct comparison cannot be made.
  • The .env.example file is listed in the file inventory but its content is not included in evidence_files, so exact default values cannot be verified.
  • The packet does not include the Langfuse application source code or the specific patch commit, so the exact code change fixing CVE-2026-24055 cannot be inspected.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4