CVE-2026-112265
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
langbot-app LangBot
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
Text from CVE List
Affected versions 1
- LangBotaffected: all versions through 4.11.0CVE List
References 6
- github.com/langbot-app/LangBot/commit/43c481d74a6388657b84baa7d292c613c75c24f9Fixvia CVE List
- vulncheck.com/advisories/langbot-through-4.11.0-missing-lark-feishu-webhook-authenticity-verificationAdvisoryvia CVE List
- github.com/langbot-app/LangBot/issues/2627Referencevia CVE List
- github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/platform/adapters/lark/adapter.pyReferencevia CVE List
- github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/platform/sources/lark.pyReferencevia CVE List
- github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/api/http/controller/groups/webhooks.pyReferencevia CVE List