Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

LangChat allows unauthenticated access to admin API

CVE-2026-111704 · published 18 days ago
Summary

The LangChat software does not check who is calling its web services, so anyone on the internet can directly use the API endpoints. Through these endpoints an attacker could view passwords, steal AI service keys, create high‑level accounts, and change or delete data. Apply the latest update or add the missing authentication check to the API controllers as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
langchat langchat <= 2a6285a6b8c51d51cdc599771bb667a30bc03f5c
Original advisory text
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published16 Oct 2026
Updated30 Oct 2026
First seen16 Oct 2026
Sources
CVE-2026-111704 · NVD
CVE-2026-111704 · MITRE
CVE-2026-111704 · OSV
Track software like this
Free during beta