{"id":"CVE-2026-112265","kind":"vulnerability","aliases":["CVE-2026-112265"],"related":[],"title":"LangBot: unauthenticated forged Lark events drive the LLM pipeline and tools","description":"LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.","summary":"LangBot through 4.11.0 skips signature verification on incoming Lark/Feishu webhook events. An attacker who knows a bot UUID can POST forged message and card-action events that run the LLM pipeline, tools and approvals as other users.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"LangBot","fixed":["4.11.1"],"affected":"<= 4.11.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-bots","ai-tooling","feishu","langbot","lark","self-hosted","webhook"],"not_affected_if":["no-lark-feishu-adapter","version-4.11.1-or-later","webhook-not-public","websocket-mode"],"how_to_check":"- Run pip show langbot (or check the image tag / WebUI version): 4.11.0 and earlier are affected, 4.11.1+ has the fix.\n- Check whether any bot uses the Lark/Feishu adapter (current or legacy 'lark' type) in Webhook Mode; WebSocket mode is not exposed this way.\n- Check whether the endpoint /<bot_uuid> is reachable from the internet. The UUID is entered as the Lark app's Request URL, so it is not a secret.\n- Check whether the bot's Encrypt Key is empty (the default).","fix":"Upgrade LangBot to 4.11.1 or later (current 4.11.3). The fix (commit 43c481d, PR #2628) checks the X-Lark-Signature header (sha256 of timestamp + nonce + Encrypt Key + body) before dispatch, and rejects requests when the bot has no Encrypt Key configured. After upgrading, set an Encrypt Key on every Lark/Feishu bot in webhook mode, or the webhook will reject all events. Workaround: use Lark WebSocket (long-connection) mode, or restrict the webhook path to Lark's IP ranges.","status":"open","published_at":"2026-10-19T14:17:03+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:02:27+00:00","updated_at":"2026-10-25T03:14:03+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:02:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"LangBot: unauthenticated forged Lark events drive the LLM pipeline and tools","impact":"high","summary":"LangBot through 4.11.0 skips signature verification on incoming Lark/Feishu webhook events. An attacker who knows a bot UUID can POST forged message and card-action events that run the LLM pipeline, tools and approvals as other users.","category":"ai-tooling","nicknames":[],"who_cares":["langbot","lark","feishu","ai-bots","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker drives the bot's LLM tools and approvals as other users","analyst_note":"Find the patched version and the fix commit for LangBot after 4.11.0 in the NVD entry references or the project repository; the sources give no fix.","how_to_check":"- Check the LangBot version in use; `4.11.0` and earlier are affected per the sources.\n- Check whether the Lark/Feishu webhook adapter is enabled on the bot.\n- Check whether bot UUIDs are exposed in public logs, URLs or client code.","needs_analyst":true,"not_affected_if":["no-lark-feishu-adapter","webhook-not-public"],"who_is_affected":"Teams running LangBot 4.11.0 or earlier with the Lark/Feishu adapter connected to a publicly reachable webhook endpoint. Deployments without the Lark/Feishu adapter, or with the webhook unreachable from the internet, are less exposed; the sources do not name a patched version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3342,"output_tokens":578,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched version and the fix commit for LangBot after 4.11.0 in the NVD entry references or the project repository; the sources give no fix.","search":"'-112265':14A,17A '-2026':13A,16A '4.11.0':34B,72C 'action':57B 'ai':20B,23B 'ai-bot':19B 'ai-tool':22B 'allow':80C 'approv':66B,112C 'attack':44B,82C,92C 'authent':76C 'bot':21B,48B,95C 'card':56B 'card-act':55B 'card.action.trigger':103C 'check':91C 'contain':73C 'cve':12A,15A 'drive':6A,106C 'event':5A,42B,58B,87C,104C 'fabric':99C 'feishu':25B 'forg':3A,52B,85C 'host':30B 'im.message.receive':100C 'incom':39B 'inject':84C 'know':46B,93C 'langbot':1A,18A,26B,32B,70C 'lark':4A,27B 'lark/feishu':40B,86C 'llm':8A,62B,108C 'messag':53B 'miss':75C 'pipelin':9A,63B,109C 'post':51B,98C 'run':60B 'self':29B 'self-host':28B 'signatur':36B,90C 'skip':35B,89C 'tool':11A,24B,64B,110C 'unauthent':2A,81C 'user':69B,115C 'uuid':49B,96C 'v1':101C 'verif':37B,77C 'vulner':78C 'webhook':31B,41B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted LangBot 4.11.0 or earlier with a Lark/Feishu bot in Webhook Mode on a reachable URL. Anyone who learns the bot UUID in the URL can send fake messages or card-button clicks as any user, and the bot's LLM pipeline, tools and approval buttons act on them. Teams using WebSocket mode, other chat platforms, or a webhook that is not reachable from the internet can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112265","severity":null,"published_at":"2026-10-19T14:17:03+00:00","modified_at":"2026-10-19T17:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112265:673","url":null,"severity":null,"published_at":"2026-10-25T03:14:03+00:00","modified_at":"2026-10-25T03:14:03+00:00","first_seen_at":"2026-10-25T03:14:03+00:00","fetched_at":"2026-10-25T03:14:03+00:00","note":"Fix is PR #2628 (merge 43c481d, 2026-10-18); v4.11.1 (2026-10-20) release notes list #2628, so 4.11.1 is the first release with it (inferred from the notes, not an explicit advisory line). Issue #2627 read from the project. No PoC public ('on request'), no exploitation seen, no vendor mitigations. Not marked verified: no maintainer advisory states the fixed version."}],"documents":[{"id":3067,"url":"https://github.com/langbot-app/LangBot/issues/2627","title":"Lark/Feishu webhook mode processes inbound events with no signature or token verification (#2627)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3068,"url":"https://github.com/langbot-app/LangBot/commit/43c481d74a6388657b84baa7d292c613c75c24f9","title":"Merge PR #2628: verify Lark webhook signature before dispatch","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3069,"url":"https://github.com/langbot-app/LangBot/releases","title":"LangBot releases (v4.11.1 lists #2628)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3071,"url":"https://www.vulncheck.com/advisories/langbot-through-4.11.0-missing-lark-feishu-webhook-authenticity-verification","title":"VulnCheck: LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}