Attack Chain

1. Attacker identifies a target organization's unique Langfuse projectId through reconnaissance or information leakage.
2. Attacker prepares a malicious Slack application configured with a callback URL pointing to the target Langfuse instance.
3. Attacker crafts an HTTP GET request to the vulnerable endpoint: /api/public/slack/install?projectId=<victim-project-id>.
4. The Langfuse application processes the request without authentication, triggering an OAuth redirect to Slack's authorization portal.
5. Attacker authorizes the malicious Slack workspace within the OAuth flow, completing the binding process.
6. The target victim, unaware of the unauthorized integration, performs routine operations such as updating or creating prompts.
7. Langfuse automation triggers, sending sensitive prompt metadata and content to the attacker-controlled Slack workspace.
8. Attacker gains full visibility into the victim's prompt library and development lifecycle events.

Impact

The successful exploitation of this vulnerability leads to the unauthorized exfiltration of sensitive AI development assets, including prompt templates, system instructions, and project metadata. Organizations utilizing Langfuse to manage LLM prompts are vulnerable to intellectual property theft. There is no requirement for user interaction or privilege acquisition to conduct this attack, making it highly impactful for publicly accessible or misconfigured Langfuse instances.

Recommendation

Prioritize the upgrade of all Langfuse deployments to version 3.147.0 or later to patch the authentication bypass on the Slack installation endpoint. Monitor web server logs for suspicious access to the /api/public/slack/install endpoint, particularly those originating from unauthenticated sessions or requests with unusual project identifiers. Review current Slack integrations within Langfuse settings to identify any unauthorized or unknown workspaces linked to sensitive projects.