HIGH 8.3 NVD
CVE-2026-112265
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by s
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
References
- https://github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/api/http/controller/gr
- https://github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/platform/adapters/lark
- https://github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/platform/sources/lark.
- https://github.com/langbot-app/LangBot/commit/43c481d74a6388657b84baa7d292c613c75c24f9
- https://github.com/langbot-app/LangBot/issues/2627
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-10-19 via NVD.
vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.