The vulnerability arises from improper role‑based access control in the schema that manages LLM connections. An authenticated user with the member role in a Langfuse project can request an update to an existing connection, specifying a malicious baseUrl. The application then re‑uses the stored provider secret to send a test request to the attacker‑controlled endpoint, leaking the plaintext LLM provider API key. This vulnerability, classified as CWE‑284, results in the disclosure of confidential credentials that could grant remote parties full access to the provider account.

Vulnerable instances of the Langfuse platform running any release between 3.68.0 and, but not including, 3.167.0 are affected. The issue was fixed in release 3.167.0, which updates the access control checks in the LLM connection update flow. Only installations that have not applied the patch and that allow members to belong to a project are at risk.

The flaw has a CVSS score of 5.3, indicating moderate severity. No EPSS score was published, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a member‑role user who already has membership in a project; the attacker then triggers the update operation. Once the malicious request is processed, the stored API key is returned to the attacker in plaintext. The attack vector is intra‑application and does not require external network access beyond normal API calls.