Advisories · Technology
langfuse.
Every CVE that names langfuse among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys
- langfuse
- Broken access control
- CVSS 6.3 Medium
Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking
- langfuse
- Broken access control
- CVSS 6.5 Medium
Langfuse SSO Account Takeover via CSRF or phishing attack
- langfuse
- Broken access control
- Cross-site request forgery (CSRF)
- CVSS 5.0 Medium
Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs
- langfuse
- CWE-202
- CVSS 2.3 Low
Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery
- Langfuse
- Server-side request forgery (SSRF)