Langfuse vulnerabilities
Products
- Langfuse 6
Newest
- langfuse Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys 5.3 Medium
- langfuse Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking 6.3 Medium
- langfuse Langfuse SSO Account Takeover via CSRF or phishing attack 6.5 Medium
- langfuse Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs 5.0 Medium
- langfuse Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317... 7.6 High
- langfuse Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery 2.3 Low