Unauthorized Slack OAuth project binding in Langfuse (/api/public/slack/install)

This repository is a small proof-of-concept/demo environment for CVE-2026-24055 affecting Langfuse. It does not contain custom exploit code; instead, it provides documentation plus two Docker Compose deployments to reproduce the vulnerable behavior in Langfuse 3.146.0 and verify the fix in 3.147.0. The core exploit capability described is an unauthenticated web attack against the public endpoint /api/public/slack/install, where an attacker who knows a victim projectId can start Slack OAuth without being logged in and bind the attacker's Slack workspace to the victim project. Once bound, victim-created Slack automations may send prompt metadata or related notifications to the attacker's workspace, resulting in information disclosure. Repository structure: README.md contains the vulnerability description, setup steps, exploitation flow, and patched-version verification steps. The vulnerable/ and patched/ directories each contain a docker-compose.yml and .env.example for spinning up full Langfuse lab environments. The compose files define langfuse-web, langfuse-worker, postgres, redis, clickhouse, and minio services, with version differences between vulnerable (3.146.0) and patched (3.147.0). The .env examples provide required configuration for database, Redis, ClickHouse, MinIO, NextAuth, and Slack OAuth. Operationally, this is a reproducible lab rather than a weaponized exploit. The attack is web-based and relies on manual browser interaction with the vulnerable endpoint and Slack OAuth consent. The README also documents expected patched behavior: unauthenticated requests should return HTTP 401, and authenticated users attempting to configure Slack for projects they do not control should receive HTTP 403.

This repository is a proof-of-concept/demo environment for CVE-2026-24055, an improper access control issue in Langfuse affecting versions 3.89.0 through 3.146.0. It does not contain custom exploit code; instead, it provides documentation plus two Docker Compose environments to reproduce the vulnerable behavior and verify the fix. The vulnerable setup runs Langfuse 3.146.0, while the patched setup runs 3.147.0. Repository structure is minimal: README.md explains the vulnerability, attack flow, setup, exploitation steps, and expected patched behavior; vulnerable/docker-compose.yml and vulnerable/.env.example define a local Langfuse stack with Slack OAuth enabled for reproducing the issue; patched/docker-compose.yml and patched/.env.example define the same stack on the fixed version for regression verification. Supporting services include PostgreSQL, Redis, ClickHouse, and MinIO. Main exploit capability: an unauthenticated attacker can browse to the public endpoint /api/public/slack/install with a victim projectId and trigger Slack OAuth without being logged into Langfuse. By authorizing their own Slack workspace, the attacker binds that workspace to the victim project. Subsequent victim-created Slack automations can then send prompt-related notifications and metadata to the attacker-controlled Slack workspace. This is a web/network attack against the Langfuse HTTP interface, centered on localhost:3000 in the demo. The repository is best classified as a POC rather than an operational exploit: there is no standalone exploit script, no automated payload delivery, and no post-exploitation tooling. It is nevertheless a valid exploit demonstration because it provides reproducible steps and infrastructure to exploit the vulnerable endpoint and confirm the security impact, as well as to verify that the patched version returns 401/403 responses instead.