EUVD-2026-28647Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An authenticated, low-privileged user of role “member” in a project could request the update of an existing LLM connection to an attacker-controlled baseUrl, causing Langfuse to reuse the stored provider secret and redirect the test request to an attacker-controlled endpoint. This could expose the plaintext provider LLM API key for that connection. The attack is only possible if a user is already part of a project and has “member” scoped access. This issue has been patched in version 3.167.0.
AnalysisAI
Langfuse versions 3.68.0 through 3.166.x contain an insufficient access control flaw allowing authenticated project members to modify LLM connection endpoints and exfiltrate stored provider API keys in plaintext. An attacker with 'member' role can update an existing LLM connection's baseUrl to an attacker-controlled server, causing Langfuse to reuse the stored provider secret and redirect test requests to that endpoint, exposing credentials like OpenAI API keys. The vulnerability requires prior project membership but no elevated privileges; it was patched in version 3.167.0.
Technical ContextAI
Langfuse is an open-source LLM engineering platform that manages connections to external LLM providers (OpenAI, etc.) by storing provider-specific API keys and base URLs. The vulnerability stems from insufficient role-based access control (RBAC) in the LLM API key update mutation endpoint. The testUpdate RPC method failed to enforce the 'llmApiKeys:update' permission scope, allowing 'member'-role users (intended to have read-only access) to invoke update operations. When updating an LLM connection, the application reuses the previously stored plaintext provider secret and initiates a test request to the supplied baseURL. By redirecting this request to attacker-controlled infrastructure, an attacker can intercept and capture the plaintext API key in transit, violating confidentiality of stored credentials. CWE-284 (Improper Access Control) describes this class of authorization bypass.
RemediationAI
Upgrade Langfuse to version 3.167.0 or later, which enforces 'llmApiKeys:update' scope requirements in the testUpdate mutation endpoint. Organizations unable to upgrade immediately should restrict the number of project members granted 'member' role access to LLM connections, limiting exposure to trusted internal personnel only. Implement network-level monitoring to detect outbound HTTPS requests from Langfuse infrastructure to unexpected endpoints (baseURL values); unusual requests to attacker-controlled domains may indicate exploitation attempts. Rotate any LLM provider API keys (OpenAI, Anthropic, etc.) that were accessible to users with 'member' role during the affected version window, as plaintext exposure is possible. See GitHub Security Advisory GHSA-2524-j966-gfgh for vendor guidance and pull requests #13027 and #13055 for detailed technical remediation.
Langfuse versions 3.146.0 and below allow unauthenticated attackers to hijack Slack OAuth integrations by injecting arbi
A security flaw has been discovered in Langfuse up to 3.88.0. Rated low severity (CVSS 2.3), this vulnerability is remot
Langfuse is an open source large language model engineering platform. Rated medium severity (CVSS 6.5), this vulnerabili
Langfuse is an open source large language model engineering platform. Rated medium severity (CVSS 5.0), this vulnerabili
Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated use
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today