LangBot EUVD-2026-104308

Requires that the LangBot deployment uses the Lark/Feishu platform adapter with its webhook endpoint network-reachable by the attacker, and that the attacker knows a valid bot UUID (used in the webhook path). Pre-patch, the adapter performed no X-Lark-Signature or verification-token check at all, so exploitation succeeds against typical/default configurations of the Lark adapter once the endpoint is exposed - the attacker does NOT need the app's Encrypt Key. Limiting factors: only affects instances running the Lark/Feishu adapter, requires the bot UUID (the AC:H/AT:P barrier), and requires direct network access to the webhook; it is unauthenticated (PR:N) with no user interaction needed.

This is a credible, above-average-priority issue but not a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw whose exploitation carries a genuine barrier: the attacker must know a valid bot UUID and the deployment must use the Lark/Feishu adapter, which is why AC:H and AT:P (attack requirements present) are set rather than a clean AV:N/AC:L. The dominant impact is integrity (VI:H): forged im.message.receive_v1 / card.action.trigger events let an attacker drive the LLM pipeline, tools, and approval actions while impersonating other users; confidentiality is only Low (VC:L) and availability unaffected (VA:N), which is consistent with the source-code evidence showing the webhook simply never validated X-Lark-Signature. On the exploitation-likelihood side, the signals are quiet: this is NOT in CISA KEV, no EPSS score was supplied, and no public PoC was provided - so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here; rather, key likelihood data (EPSS) is MISSING and should not be treated as either high or low. Net: a real authentication-bypass/spoofing weakness with high integrity impact and a vendor patch available, but tempered by the UUID-knowledge prerequisite and the relatively niche deployment footprint of LangBot, making it a solid patch-soon item rather than mass-exploitation-imminent.

An attacker identifies a LangBot instance exposing the Lark/Feishu webhook endpoint and learns a valid bot UUID (e.g. from the webhook URL path). They POST a fabricated im.message.receive_v1 or card.action.trigger event with no valid X-Lark-Signature; because pre-patch code performs no authenticity check, the forged event is accepted and processed as if it came from a legitimate user, letting the attacker drive the LLM pipeline, invoke tools, and approve actions as another user. No public exploit code is identified at time of analysis.