{"data":{"id":"9f0f718a-cf64-434f-8a53-f60712d8ea63","title":"CVE-2026-24055: Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the…","summary":"CVE-2026-24055 affects Langfuse versions 3.146.0 and below. The /api/public/slack/install endpoint starts Slack OAuth with a client-supplied projectId and no authentication or authorization, and the callback stores installations based on that untrusted value. An attacker can bind their Slack workspace to any project and potentially receive changes to prompts in Prompt Management, replacing existing Prompt Slack Automation integrations or pre-registering a malicious one that requires an authenticated user to configure it unknowingly.","solution":"Fixed in 3.147.0.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24055","publishedAt":"2026-01-22T04:16:00.367Z","cveId":"CVE-2026-24055","cweIds":["CWE-284"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Langfuse"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langfuse unauthenticated Slack installation binding to any project","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00431,"epssCheckedAt":"2026-11-04T12:08:34.749Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:42.436Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}