CVE-2026-112265— LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
Quick assessment
Affected
langbot-app LangBot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LangBot 4.11.0 及更早版本存在一个缺少真实性验证的漏洞，允许未认证的攻击者通过绕过签名检查来注入伪造的 Lark/Feishu（飞书）事件。若攻击者知晓某个机器人的 UUID，即可向该机器人 POST 伪造的 或 事件，从而以其他用户的身份驱动大型语言模型（LLM）流水线、调用工具或触发审批流程。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| langbot-app | LangBot | ≤ 4.11.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112265
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
Source: CVE Program / CVE List V5
Vulnerability Description
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| langbot-app | LangBot | 0 ~ 4.11.0 | - |
|
II. Public POCs for CVE-2026-112265
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112265
请登录查看更多情报信息。
Other References for CVE-2026-112265 (4)
IV. Related Vulnerabilities
Same product: LangBot
-
CVE-2026-90938
LangBot through 0.4.17 Unauthenticated Plugin Registration v -
CVE-2026-90562
LangBot before 4.10.11 Authentication Bypass via Weak Recove -
CVE-2026-54449
LangBot: Authenticated RCE Via MCP Configuration -
CVE-2026-28509
LangBot has a Cross Site Scripting(XSS) Vulnerability -
CVE-2025-59835
LangBot has a cross-directory file upload vulnerability, whi
Same vendor: langbot-app
-
CVE-2026-90938
LangBot through 0.4.17 Unauthenticated Plugin Registration v -
CVE-2026-90562
LangBot before 4.10.11 Authentication Bypass via Weak Recove -
CVE-2026-54449
LangBot: Authenticated RCE Via MCP Configuration -
CVE-2026-28509
LangBot has a Cross Site Scripting(XSS) Vulnerability -
CVE-2025-59835
LangBot has a cross-directory file upload vulnerability, whi
Same weakness: CWE-345
-
CVE-2026-112161
Lack of integrity checks in Mobatek’s MobaXterm -
CVE-2026-16460
Bootc: ostree: bootc/ostree: staged deployments not revalida -
CVE-2026-16487
Bootc: containers-common: bootc: automatic updates can apply -
CVE-2026-111392
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /g -
CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and appl
V. Comments for CVE-2026-112265
No comments yet