CVE-2026-111704

9.8Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-306

Impact

Unauthenticated remote attackers can query REST controllers over the network to read plaintext passwords, exfiltrate LLM provider API keys, and create super-admin accounts. They need zero privileges or user interaction to fully compromise, modify, or wipe data.

Root cause

The application fails to register a Sa-Token interceptor on its REST endpoints, leaving sensitive controller routes globally exposed without access controls.

Affected systems

LangChat through commit 2a6285a

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

No patched release version is currently listed. Restrict network access to LangChat immediately via firewall or reverse proxy, or implement route-level authentication in front of the application until an updated commit or release registers the Sa-Token interceptor.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111704