CVE-2026-41487

Katalog CVE

CVSS 5.4 · Medium EPSS 0,32%

Kerentanan Improper Access Control pada langfuse. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An authenticated, low-privileged user of role “member” in a project could request the update of an existing LLM connection to an attacker-controlled baseUrl, causing Langfuse to reuse the stored provider secret and redirect the test request to an attacker-controlled endpoint. This could expose the plaintext provider LLM API key for that connection. The attack is only possible if a user is already part of a project and has “member” scoped access. This issue has been patched in version 3.167.0.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langfuse/langfuse/security/advisories/GHSA-2524-j966-gfgh mitigasi · patch · advisory vendor
• https://github.com/langfuse/langfuse/commit/7527bb0d84bc0a3dc24a4b16d22ed2e46e6dddff patch
• https://github.com/langfuse/langfuse/commit/e12386f9d4368bbfff24a4ad7fd53641091605ff patch
• https://github.com/langfuse/langfuse/pull/13027 issue tracking · patch
• https://github.com/langfuse/langfuse/pull/13055 issue tracking · patch
• https://github.com/langfuse/langfuse/releases/tag/v3.167.0 release notes