Live › vulnerability › CVE-2026-111704
Go to dashboardLangChat, an AI chat application, does not register its Sa-Token authentication interceptor, so its REST controllers accept unauthenticated requests. An unauthenticated remote attacker can read user passwords and LLM provider API keys, create super-admin accounts, and modify or delete data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| langchat | github | <= commit 2a6285a6b8c51d51cdc599771bb667a30bc03f5c (no release tags) | – |
curl -i http://<host>:8080/api/v1/auth/users with no Authorization header (default port 8080)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
This page as .md · .json · in your agent: get_signal("CVE-2026-111704")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.