What happened
A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.
Affected versions
Langfuse: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8; 3.9; 3.10; 3.11; 3.12; 3.13; 3.14; 3.15; 3.16; 3.17; 3.18; 3.19; 3.20; 3.21; 3.22; 3.23; 3.24; 3.25; 3.26; 3.27; 3.28; 3.29; 3.30; 3.31; 3.32; 3.33; 3.34; 3.35; 3.36; 3.37; 3.38; 3.39; 3.40; 3.41; 3.42; 3.43; 3.44; 3.45; 3.46; 3.47; 3.48; 3.49; 3.50; 3.51; 3.52; 3.53; 3.54; 3.55; 3.56; 3.57; 3.58; 3.59; 3.60; 3.61; 3.62; 3.63; 3.64; 3.65; 3.66; 3.67; 3.68; 3.69; 3.70; 3.71; 3.72; 3.73; 3.74; 3.75; 3.76; 3.77; 3.78; 3.79; 3.80; 3.81; 3.82; 3.83; 3.84; 3.85; 3.86; 3.87; 3.88.0 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.