Llangfuse

Products

Exploited and recent CVEs

• CVE-2026-41487 Medium 5.3 Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys 0.2%
• CVE-2026-24055 Medium 6.3 Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking 0.4%
• CVE-2025-65107 Medium 6.5 Langfuse SSO Account Takeover via CSRF or phishing attack 0.2%
• CVE-2025-64504 Medium 5.0 Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs 0.3%