{"id":"CVE-2026-111704","kind":"vulnerability","aliases":["CVE-2026-111704"],"related":[],"title":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote…","description":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.","summary":"LangChat, an AI chat application, does not register its Sa-Token authentication interceptor, so its REST controllers accept unauthenticated requests. An unauthenticated remote attacker can read user passwords and LLM provider API keys, create super-admin accounts, and modify or delete data.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"langchat","fixed":[],"affected":"<= commit 2a6285a6b8c51d51cdc599771bb667a30bc03f5c (no release tags)","ecosystem":"github"}],"ecosystems":["github"],"tags":["ai-tooling","langchat","llm-api-keys","self-hosted","spring-boot"],"not_affected_if":["default-config","not-network-reachable"],"how_to_check":"Self-hosted only. From a host outside your network, run: curl -i http://<host>:8080/api/v1/auth/users with no Authorization header (default port 8080). A 200 with a user list means exposed; also try /api/v1/aigc/models. In source: no SaInterceptor, SaServletFilter or HandlerInterceptor registered, and @SaCheckLogin only on /api/v1/auth/me and /api/v1/auth/access-routes. Any build from the next branch at or before 2a6285a6b8c51d51cdc599771bb667a30bc03f5c is affected.","fix":"No fixed version. Until upstream ships one: keep LangChat off untrusted networks or put an authenticating reverse proxy in front. Or register a global Sa-Token SaInterceptor requiring login on all routes except login/logout, add permission checks on admin controllers, and stop serializing password and apiKey. Treat all stored LLM provider API keys and user passwords as exposed: rotate them, and check aigc_user for unexpected admin accounts.","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:04:58+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T22:04:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"LangChat, an AI chat application, does not register its Sa-Token authentication interceptor, so its REST controllers accept unauthenticated requests. An unauthenticated remote attacker can read user passwords and LLM provider API keys, create super-admin accounts, and modify or delete data.","category":"ai-tooling","who_cares":["langchat","self-hosted","llm-api-keys"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker gains super-admin access, reads plaintext passwords and LLM API keys.","analyst_note":"Find out whether a patched LangChat release exists after commit 2a6285a and check the NVD entry for a fixed version and deployment check; sources give no fix or version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00045,"input_tokens":2782,"output_tokens":344,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find out whether a patched LangChat release exists after commit 2a6285a and check the NVD entry for a fixed version and deployment check; sources give no fix or version.","search":"'-111704':16A,19A '-2026':15A,18A '/api/v1/auth/users':108C '2a6285a':4A,82C 'accept':53B 'access':94C 'account':73B,122C 'admin':72B,121C 'ai':22B,37B 'ai-tool':21B 'allow':11A,89C 'api':27B,67B,116C 'applic':39B 'attack':59B,92C,105C 'authent':8A,47B,86C 'boot':34B 'chat':38B 'commit':3A,81C 'contain':5A,83C 'control':52B,96C 'creat':69B,118C 'cve':14A,17A 'data':78B,127C 'delet':77B,126C 'host':31B 'interceptor':48B,102C 'key':28B,68B,117C 'langchat':1A,20A,24B,35B,79C 'llm':26B,65B,114C 'llm-api-key':25B 'miss':7A,85C 'modifi':75B,124C 'password':63B,112C 'plaintext':111C 'provid':66B,115C 'queri':107C 'read':61B,110C 'regist':42B,104C 'remot':13A,58B,91C 'request':55B 'rest':51B,95C 'retriev':113C 'sa':45B,100C 'sa-token':44B,99C 'self':30B 'self-host':29B 'spring':33B 'spring-boot':32B 'super':71B,120C 'super-admin':70B,119C 'token':46B,101C 'tool':23B 'unauthent':12A,54B,57B,90C 'user':62B 'vulner':9A,87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111704","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-21T22:16:46+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111704:232","url":null,"severity":null,"published_at":"2026-10-23T22:28:34+00:00","modified_at":"2026-10-23T22:28:34+00:00","first_seen_at":"2026-10-23T22:28:34+00:00","fetched_at":"2026-10-23T22:28:34+00:00","note":"No patched LangChat exists: project publishes no release tags, the default branch next head was 2a6285a (Sep 27) on the GitHub commits page I read, and VulnCheck, CVE record and finder name no fix. Found by source review only; CISA-ADP SSVC says exploitation: poc (the write-up has illustrative requests, no runnable PoC). Not seen exploited."}],"documents":[{"id":1465,"url":"https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure","title":"LangChat missing global auth (finder write-up, hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1466,"url":"https://www.vulncheck.com/advisories/langchat-through-commit-2a6285a-missing-authentication-on-rest-api-controllers","title":"VulnCheck advisory: LangChat missing authentication","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1467,"url":"https://theinjection.dev/items/langchat-rest-controllers-missing-auth/","title":"LangChat: the REST API answers callers who never logged in","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}