---
id: "CVE-2026-112265"
kind: "vulnerability"
aliases: ["CVE-2026-112265"]
title: "LangBot: unauthenticated forged Lark events drive the LLM pipeline and tools"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "LangBot", "fixed": ["4.11.1"], "affected": "<= 4.11.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-bots", "ai-tooling", "feishu", "langbot", "lark", "self-hosted", "webhook"]
not_affected_if: ["no-lark-feishu-adapter", "version-4.11.1-or-later", "webhook-not-public", "websocket-mode"]
published_at: "2026-10-19T14:17:03+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:14:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112265", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:14:03+00:00"}]
---

# LangBot: unauthenticated forged Lark events drive the LLM pipeline and tools

LangBot through 4.11.0 skips signature verification on incoming Lark/Feishu webhook events. An attacker who knows a bot UUID can POST forged message and card-action events that run the LLM pipeline, tools and approvals as other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:LangBot affected <= 4.11.0 fixed 4.11.1

## How to check

- Run pip show langbot (or check the image tag / WebUI version): 4.11.0 and earlier are affected, 4.11.1+ has the fix.
- Check whether any bot uses the Lark/Feishu adapter (current or legacy 'lark' type) in Webhook Mode; WebSocket mode is not exposed this way.
- Check whether the endpoint /<bot_uuid> is reachable from the internet. The UUID is entered as the Lark app's Request URL, so it is not a secret.
- Check whether the bot's Encrypt Key is empty (the default).

## Fix

Upgrade LangBot to 4.11.1 or later (current 4.11.3). The fix (commit 43c481d, PR #2628) checks the X-Lark-Signature header (sha256 of timestamp + nonce + Encrypt Key + body) before dispatch, and rejects requests when the bot has no Encrypt Key configured. After upgrading, set an Encrypt Key on every Lark/Feishu bot in webhook mode, or the webhook will reject all events. Workaround: use Lark WebSocket (long-connection) mode, or restrict the webhook path to Lark's IP ranges.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112265
- 2026-10-25T03:14:03+00:00 analyst — Fix is PR #2628 (merge 43c481d, 2026-10-18); v4.11.1 (2026-10-20) release notes list #2628, so 4.11.1 is the first release with it (inferred from the notes, not an explicit advisory line). Issue #2627 read from the project. No PoC public ('on request'), no exploitation seen, no vendor mitigations. Not marked verified: no maintainer advisory states the fixed version.

## Documents

- [advisory] VulnCheck: LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification https://www.vulncheck.com/advisories/langbot-through-4.11.0-missing-lark-feishu-webhook-authenticity-verification
- [describes] Lark/Feishu webhook mode processes inbound events with no signature or token verification (#2627) https://github.com/langbot-app/LangBot/issues/2627
- [fix] Merge PR #2628: verify Lark webhook signature before dispatch https://github.com/langbot-app/LangBot/commit/43c481d74a6388657b84baa7d292c613c75c24f9
- [fix] LangBot releases (v4.11.1 lists #2628) https://github.com/langbot-app/LangBot/releases

## From the sources

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_