Description
A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Langfuse | 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, 3.24, 3.25, 3.26, 3.27, 3.28, 3.29, 3.30, 3.31, 3.32, 3.33, 3.34, 3.35, 3.36, 3.37, 3.38, 3.39, 3.40, 3.41, 3.42, 3.43, 3.44, 3.45, 3.46, 3.47, 3.48, 3.49, 3.50, 3.5… | — |
References
- VDB-322114 | Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery vdb-entry technical-description
- VDB-322114 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #641128 | langfuse https://github.com/langfuse/langfuse <=3.88.0 SSRF third-party-advisory
- https://github.com/langfuse/langfuse/issues/8522 issue-tracking
- https://github.com/langfuse/langfuse/issues/8522#issue-3320549867 exploit issue-tracking