Description
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
Published: 2026-10-19
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Authorization Bypass
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is missing authenticity verification for Lark/Feishu webhook endpoints in LangBot up to version 4.11.0. Attackers can POST forged im.message.receive_v1 or card.action.trigger events without any signature check, enabling them to inject arbitrary commands into the LLM pipeline, trigger tools, and approve actions as if they were legitimate users. This effectively allows unauthorized command execution and could lead to manipulation of data or unauthorized actions by the bot.

Affected Systems

The affected product is LangBot from langbot-app, versions up to and including 4.11.0. No specific patch version is listed, so any deployment of those versions remains vulnerable until a fix is released.

Risk and Exploitability

The CVSS score of 8.3 classifies this flaw as a high‑severity vulnerability. The EPSS score is not available, but the lack of required authentication and the public webhook endpoint imply a potentially high exploitation probability. The flaw is not currently listed in the CISA KEV catalog, but attackers who know a bot UUID can target the endpoint from any network location, making the risk real for exposed deployments.

Generated by OpenCVE AI on October 19, 2026 at 15:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update LangBot to a version that implements webhook authenticity checks.
  • If an update cannot be applied immediately, limit access to the webhook endpoint by using network segmentation, firewall rules, or IP whitelisting so that only trusted Lark/Feishu servers can reach it.
  • As a temporary workaround, add custom code to validate the signature or bot UUID on incoming webhook requests before processing them, ensuring that only legitimate events are accepted.

Generated by OpenCVE AI on October 19, 2026 at 15:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
Title LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
First Time appeared Langbot
Langbot langbot
Weaknesses CWE-345
CPEs cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:*
Vendors & Products Langbot
Langbot langbot
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Langbot Langbot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T16:35:03.804Z

Reserved: 2026-10-19T13:25:24.098Z

Link: CVE-2026-112265

cve-icon Vulnrichment

Updated: 2026-10-19T15:35:57.139Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T14:17:03.277

Modified: 2026-10-19T17:17:14.843

Link: CVE-2026-112265

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:00:15Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity