Langfuse CVE-2026-41487

Attacker must have authenticated access to a Langfuse project with 'member' role or higher. The victim project must have at least one pre-existing LLM connection with a stored provider secret (e.g., OpenAI API key). The attacker invokes the testUpdate RPC method with a modified baseURL parameter pointing to attacker-controlled infrastructure. Exploitation does NOT require admin privileges, RBAC bypasses, or non-default configuration; any project with 'member' users and stored secrets is vulnerable. Limitation: the attack is confined to exfiltrating the specific LLM provider secret associated with the connection being updated; it does not grant access to other project data, user credentials, or platform secrets. The attacker must already be authenticated (no unauthenticated exposure) and must have been granted project membership by an admin or project owner.

CVSS 5.3 (Low-Medium severity) combined with explicit authentication requirement (PR:L - low-privileged authenticated user) reflects the true operational risk accurately. EPSS data not provided, but the vulnerability is realistic and not theoretical: proof-of-concept is evident in GitHub commit evidence, showing test cases explicitly validating that member-role users are now blocked from testUpdate operations. KEV status not provided, but no indication of active widespread exploitation has been identified at analysis time. The attack requires a low-privileged but authenticated actor already embedded in a project, which narrows the attack surface compared to unauthenticated network attacks. However, for organizations using Langfuse with multi-tenant or collaborative projects, member-level compromise (via phishing, credential stuffing, or insider threat) is realistic, making this a moderate operational risk for environments with sensitive LLM API keys. The lack of network complexity (AC:L, AT:N) means exploitation is trivial once authentication is obtained. Signal consistency: CVSS vector accurately reflects the requirement for authentication (PR:L) and limited scope impact (VC:L, VI:L - confidentiality and integrity limited to the LLM connection secret itself, not the platform core).

A disgruntled employee or external attacker with 'member' role access to a Langfuse project containing OpenAI LLM connections requests an update to an existing connection, modifying the baseURL from 'https://api.openai.com/v1' to 'https://attacker.example.com/v1'. Langfuse retrieves the stored plaintext OpenAI API key and initiates a test request to the attacker's server to validate the connection, automatically sending the key in the HTTP request headers. The attacker's server logs the request and captures the API key, which can then be used to make authenticated calls to OpenAI's API or sold on darkweb markets.