CVE-2026-112265
validatedZero produced an exploit or a check.GHSA-73v9-9646-vcm5 ↗EUVD-2026-104308 ↗
description
LangBot through 4.11.0 does not adequately verify the authenticity of Lark/Feishu webhook events. An unauthenticated attacker who knows a bot UUID may cause forged events to be processed as other users, potentially invoking LLM workflows, tools, or approvals.
mitigation
Restrict access to LangBot's Lark/Feishu webhook endpoints to trusted sources and block unnecessary public exposure. Apply a vendor update that adds webhook signature verification when one is available; no fixed version is recorded in the advisory.
outcome
Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-19 13:55Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-112265
{ "etk_id": "ETK-2026-2098", "cve_id": "CVE-2026-112265", "display_id": "CVE-2026-112265", "ghsa_id": "GHSA-73v9-9646-vcm5", "euvd_id": "EUVD-2026-104308", "status": "published", "anchor_state": "anchored", "title": "Missing webhook authenticity verification in LangBot", "summary": "LangBot through 4.11.0 does not adequately verify the authenticity of Lark/Feishu webhook events. An unauthenticated attacker who knows a bot UUID may cause forged events to be processed as other users, potentially invoking LLM workflows, tools, or approvals.", "mitigation": "Restrict access to LangBot's Lark/Feishu webhook endpoints to trusted sources and block unnecessary public exposure. Apply a vendor update that adds webhook signature verification when one is available; no fixed version is recorded in the advisory.", "vendor": "langbot-app", "product": "LangBot", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 4.11.0" ], "ecosystem": "pypi", "fixed_versions": [], "package_name": "LangBot", "purl": "pkg:pypi/LangBot" } ], "cwes": [ 345 ], "cvss_score": 8.3, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "epss_score": 0.0015, "epss_percentile": 0.0413, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": true, "pipeline_minutes": 26.338287083333334, "t0_at": "2026-10-19T13:55:15.112000+00:00", "signals": { "check": { "at": "2026-10-20T00:47:32.793052+00:00", "days": 0.45298241958333335, "is_lower_bound": false, "measured_at": "2026-10-19T13:55:15.112000+00:00", "url": null }, "exploit": { "at": "2026-10-20T00:47:32.793052+00:00", "days": 0.45298241958333335, "is_lower_bound": false, "measured_at": "2026-10-19T13:55:15.112000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-19T13:55:15.112000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-19T13:55:15.112000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-112265" } } }
published 2026-10-20 00:21Z
last change 2026-10-21 14:43Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.