CVE-2026-24055: 
Wolfi vulnerability analysis and mitigation

CVE-2026-24055 is an unauthenticated Slack OAuth installation vulnerability in Langfuse, an open-source LLM engineering platform, that allows attackers to bind their Slack workspace to any arbitrary project without authentication. The vulnerability affects Langfuse versions 3.89.0 through 3.146.0 and was disclosed on January 22, 2026, with a patch released on January 15, 2026 (version 3.147.0). It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is improper access control (CWE-284) and missing authorization (CWE-862) on the /api/public/slack/install endpoint. This endpoint initiates a Slack OAuth flow using a projectId query parameter supplied entirely by the client, with no authentication or authorization check performed before or during the flow. The projectId is preserved throughout the OAuth callback, and the resulting Slack installation is stored against the attacker-controlled project identifier. The fix (commit 3adc89e) added session authentication checks and RBAC scope validation (automations:CUD) to the install endpoint before initiating the OAuth flow (GitHub Advisory, Fix Commit).

A successful exploit allows an unauthenticated attacker to link their own Slack workspace to any Langfuse project by knowing or guessing a valid projectId. If the victim project already has a Prompt Slack Automation configured, Langfuse will begin sending prompt updates to the attacker's Slack workspace, exposing LLM-managed prompts. No tracing data, LLM-as-a-Judge data, or PII captured in Langfuse Tracing is transmitted via this integration, limiting the confidentiality impact primarily to prompt content. An attacker can also pre-register a malicious Slack integration that may later be unknowingly selected by a legitimate user when configuring automations (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, detailing the exact steps to exploit the endpoint using an incognito browser session. The EPSS score is approximately 0.026%, indicating low current exploitation probability. There is no evidence of in-the-wild exploitation; the Langfuse team reviewed database state and access logs for Langfuse Cloud and confirmed the vulnerability was not exploited prior to patching. The vulnerability is not listed in the CISA KEV catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible Langfuse instance running versions 3.89.0–3.146.0. Obtain or enumerate a valid projectId (e.g., from shared links, public project references, or brute-force of UUID formats).
2. Initiate OAuth flow: Open an incognito browser session and navigate to https://<langfuse-host>/api/public/slack/install?projectId=<victim-project-id>. No authentication is required at this step.
3. Complete Slack OAuth: Click "Add to Slack" and authenticate with the attacker's own Slack workspace. The projectId is preserved in the OAuth state throughout the flow.
4. Slack workspace linked: After the OAuth callback completes, the attacker's Slack workspace is stored as the Slack integration for the victim project without any Langfuse authentication.
5. Receive prompt data: If the victim project has a Prompt Slack Automation configured, Langfuse will begin delivering prompt updates to the attacker's Slack workspace. If not, the attacker's integration remains attached and may be selected by a legitimate user in a future automation setup (GitHub Advisory).

• Network: Unexpected GET requests to /api/public/slack/install from unauthenticated sessions (no session cookie or auth header); OAuth callback requests to /api/public/slack/callback originating from unknown Slack workspace IDs.
• Logs: Langfuse server logs showing Unauthenticated Slack install attempt warnings (added in the patched version); repeated install requests for the same projectId from different IP addresses.
• Application State: Slack integration records in the database referencing unfamiliar Slack workspace names or team IDs not recognized by project administrators; unexpected changes to the Slack workspace displayed in project integration settings.
• Audit Logs: Missing or absent audit log entries for Slack integration creation events (pre-patch versions did not generate audit logs for this action) (GitHub Advisory, Fix Commit).

Upgrade Langfuse to version 3.147.0 or later, which enforces authentication and RBAC authorization (automations:CUD scope) on the /api/public/slack/install endpoint. For organizations unable to patch immediately, implement network-level access controls to restrict access to the /api/public/slack/install endpoint to authenticated internal users only. As a remediation step, review the Slack integration settings in all projects and verify that the linked Slack workspace is owned and controlled by your organization; re-connect the Slack workspace from project settings if any suspicious workspace is found (GitHub Advisory, Release v3.147.0).

The vulnerability was discovered by Aikido Security (via Aikido Attack automated scanning) and reported by researchers reindaelman, grumpinout1, and JorianWoltjer. The Langfuse team responded quickly, patching Langfuse Cloud within one day of the report (January 15, 2026) and publishing an OSS release the same day. The advisory notes that the vulnerability was not exploited on Langfuse Cloud based on log review. No significant broader media coverage or notable community controversy has been observed (GitHub Advisory).