CVE-2026-112265 Details
Description
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
A vulnerability exists in LangBot versions through 4.11.0, where the Lark/Feishu webhook integration lacks proper authenticity verification. This flaw allows unauthenticated attackers to inject fake events by bypassing signature checks. Attackers who know a bot's UUID can send fabricated 'im.message.receive_v1' or 'card.action.trigger' events, manipulating the bot's response as if they were genuine user interactions. The issue arises because the webhook handler processes incoming events without verifying their origin, leaving the bot open to exploitation.
Users can update to LangBot version 4.11.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the LangBot repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LangBot | <= 4.11.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |