Security readout for executives and security teams
Plain-English summary
Langfuse versions before 3.147.0 could let an unauthenticated attacker connect their Slack workspace to someone else’s Langfuse project through the Slack install flow. This could expose or redirect prompt-change notifications from Prompt Management. The issue is fixed in 3.147.0. No public source provided indicates active exploitation.
Executive priority
Prioritize in normal patch cycles, faster if Slack prompt notifications are used for sensitive workflows. Business impact is targeted integrity and notification exposure, not broad remote code execution. Upgrade and audit integrations.
Technical view
The /api/public/slack/install endpoint accepted a client-supplied projectId without authentication or authorization. That projectId was preserved through OAuth and used by the callback to store Slack installations. Affected Langfuse versions are >=3.89.0 and <3.147.0. CVSS v4.0 is 6.3, with network access, no privileges, no user interaction, and low integrity impact.
Likely exposure
Exposure applies to self-hosted or managed Langfuse deployments running affected versions and using, or able to configure, Prompt Management Slack automation. Risk is higher where project identifiers are discoverable and Slack integration is enabled or planned.
Exploitation context
Sources describe arbitrary project linking, replacement of existing Slack automation, or pre-registration of a malicious integration. Pre-registration still requires an authenticated user to later configure it despite visible workspace and channel indicators. The CVE is not listed as KEV in the provided bundle.
Researcher notes
The advisory attributes the flaw to missing authz on Slack OAuth initiation and trusting metadata across callback handling. Evidence supports arbitrary Slack workspace binding to projects, but not confirmed exploitation. Avoid assuming broader data access beyond prompt-change notification behavior described by sources.
Mitigation direction
- Upgrade Langfuse to version 3.147.0 or later.
- Review vendor advisory and release notes before deployment.
- Audit existing Prompt Management Slack integrations for unexpected workspaces or channels.
- Remove and recreate suspicious Slack automation integrations after upgrading.
Validation and detection
- Inventory Langfuse versions and identify deployments below 3.147.0.
- Check whether Slack Prompt Management integrations are enabled.
- Review project Slack integration records for unfamiliar workspaces or channels.
- Confirm the installed version includes the referenced fix commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24055 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/langfuse/langfuse/security/advisories/GHSA-pvq7-vvfj-p98xCVE reference · x_refsource_CONFIRM
- https://github.com/langfuse/langfuse/commit/3adc89e4d72729eabef55e46888b8ce80a7e3b0aCVE reference · x_refsource_MISC
- https://github.com/langfuse/langfuse/releases/tag/v3.147.0CVE reference · x_refsource_MISC
- https://langfuse.com/docs/prompt-management/features/webhooks-slack-integrationsCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.