Medium 6.5Published Oct 19, 2026

CVE-2026-112265LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

Updated under an hour ago (2026-10-21 02:10 UTC)

Does this affect you?

It affects langbot-app LangBot. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for langbot-app LangBot

Exploited in the last 30 days

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Weakness (CWE): CWE-345
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

langbot-app LangBot langbot_app:langbot (from the name)	through 4.11.0	CNA record

References

https://github.com/langbot-app/LangBot/issues/2627issue-tracking
https://github.com/langbot-app/LangBot/commit/43c481d74a6388657b84baa7d292c613c75c24f9patch
https://github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/platform/adapters/lark/adapter.pytechnical-description
https://github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/platform/sources/lark.pytechnical-description
https://github.com/langbot-app/LangBot/blob/v4.11.0/src/langbot/pkg/api/http/controller/groups/webhooks.pytechnical-description
https://www.vulncheck.com/advisories/langbot-through-4.11.0-missing-lark-feishu-webhook-authenticity-verificationthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.