CVE-2026-24055

🗓️ 22 Jan 2026 03:07:03Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 14 Views🌐 WEB

CVE-2026-24055: OAuth install endpoint lacks auth, enabling arbitrary project linking; fixed.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Improper Access Control in Langfuse	14 May 202603:59	–	githubexploit
ATTACKERKB	CVE-2026-24055	22 Jan 202603:07	–	attackerkb
Circl	CVE-2026-24055	22 Jan 202607:25	–	circl
CNNVD	langfuse Access Control Vulnerability	22 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking	22 Jan 202603:07	–	cvelist
EUVD	EUVD-2026-4216	22 Jan 202603:07	–	euvd
NVD	CVE-2026-24055	22 Jan 202604:16	–	nvd
OSV	CVE-2026-24055 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking	22 Jan 202603:07	–	osv
Positive Technologies	PT-2026-3911	22 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-24055	23 Jan 202606:19	–	redhatcve

NVD

Vulners

Node

langfuse langfuseRange3.89.0–3.147.0

[
  {
    "vendor": "langfuse",
    "product": "langfuse",
    "versions": [
      {
        "version": ">= 3.89.0, < 3.147.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0a
langfuse	www.langfuse.com/docs/prompt-management/features/webhooks-slack-integrations
github	www.github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98x
github	www.github.com/langfuse/langfuse/releases/tag/v3.147.0

Parameter	Position	Path	Description	CWE
projectId	path	api/public/slack/install	Unauthenticated Slack OAuth install endpoint that binds attacker Slack workspace to a victim project via untrusted projectId	CWE-284, CWE-862

17 Feb 2026 17:46Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.3

CVSS 46.3

EPSS0.00041

SSVC