langfuse records

6 published records for vendor langfuse.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

6 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2025-59305No exploit	Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migratiolangfuse · langfuse · CWE-285 Broken access control (IDOR)	High7.6	—	0.3%	Sep 24, 2025
26Monitor	CVE-2025-65107No exploit	Langfuse SSO Account Takeover via CSRF or phishing attacklangfuse · langfuse · CWE-285 Pre-auth Broken access control (IDOR) CSRF	Medium6.5	—	0.2%	Nov 21, 2025
25Monitor	CVE-2026-24055Proof of concept	Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linkinglangfuse · langfuse · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	Medium6.3	—	0.4%	Jan 22, 2026
21Monitor	CVE-2026-41487No exploit	Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keyslangfuse · langfuse · CWE-284 Broken access control (IDOR)	Medium5.3	—	0.3%	May 8, 2026
20Monitor	CVE-2025-64504No exploit	Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIslangfuse · langfuse · CWE-202	Medium5.0	—	0.3%	Nov 10, 2025
5Monitor	CVE-2025-9799No exploit	Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgerylangfuse · langfuse · CWE-918 SSRF	Low1.3	—	0.3%	Sep 1, 2025

CVE-2025-59305
30Monitor
Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migratio
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
langfuse · langfuseSep 24, 2025
CVE-2025-65107
26Monitor
Langfuse SSO Account Takeover via CSRF or phishing attack
MediumCVSS 6.5No exploitEPSS 0%
langfuse · langfuseNov 21, 2025
CVE-2026-24055
25Monitor
Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking
MediumCVSS 6.3Proof of conceptEPSS 0%
langfuse · langfuseJan 22, 2026
CVE-2026-41487
21Monitor
Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys
MediumCVSS 5.3No exploitEPSS 0%
- Broken access control (IDOR)
langfuse · langfuseMay 8, 2026
CVE-2025-64504
20Monitor
Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs
MediumCVSS 5.0No exploitEPSS 0%
langfuse · langfuseNov 10, 2025
CVE-2025-9799
5Monitor
Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery
LowCVSS 1.3No exploitEPSS 0%
- SSRF
langfuse · langfuseSep 1, 2025