ADVISORY UNAUTH-2026-0038
TYPE cve
PRODUCT Langfuse
SEVERITY MEDIUM

MEDIUM

Langfuse CVE-2026-41487

published 2026-08-05 · updated 2026-08-05

Why it matters

RBAC flaw in the LLM connection update flow: an authenticated project member could point an existing LLM connection at an attacker-controlled baseUrl, exposing the stored plaintext provider API key. CVSS 5.4.

Affected versions

>=3.68.0,<3.167.0

Fixed in: 3.167.0

Mapping provenance: human-verified against the linked advisory, last checked 2026-07-29.

Fix it

Fix card: cve-2026-41487 →

References

https://github.com/langfuse/langfuse/security/advisories/GHSA-2524-j966-gfgh

Cite this record

unauth.dev advisory UNAUTH-2026-0038 — published 2026-08 · CC-BY 4.0

Canonical URL: https://unauth.dev/advisories/UNAUTH-2026-0038. This record is part of the unauth.dev advisory dataset, published under CC-BY 4.0: attribute "unauth.dev / Raúl Acedo". Schema: additive-only within v1; this id will never be renumbered or reused.