PT-2026-39011 · Langfuse · Langfuse

Mustafabilgici · Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-41487

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Langfuse versions 3.68.0 through 3.166.0

Description A role-based access control flaw exists in the LLM connection update flow. An authenticated user with the "member" role in a project can request an update to an existing LLM connection by changing the baseUrl to one controlled by an attacker. This causes the system to reuse the stored provider secret and redirect the test request to the attacker-controlled endpoint, potentially exposing the plaintext provider LLM API key for that connection.

Recommendations Update to version 3.167.0.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-41487

Affected Products

Langfuse

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-41487 · Security Note
• https://github.com/langfuse/langfuse/pull/13055 · Note
• https://github.com/langfuse/langfuse/pull/13027 · Note
• https://github.com/langfuse/langfuse/security/advisories/GHSA-2524-j966-gfgh · Note
• https://github.com/langfuse/langfuse/commit/e12386f9d4368bbfff24a4ad7fd53641091605ff · Note
• https://github.com/langfuse/langfuse/commit/7527bb0d84bc0a3dc24a4b16d22ed2e46e6dddff · Note
• https://github.com/langfuse/langfuse/releases/tag/v3.167.0 · Note
• https://twitter.com/CVEnew/status/2052767582659518845 · Twitter Post