{"metadata": {"vulnerability": "CVE-2026-111704", "count": 15, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111704", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:31:22.259Z", "date_only": false, "value": "2026-10-16T14:31:22.259Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111704", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:56.489Z", "date_only": false, "value": "2026-10-16T17:39:56.489Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111704", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:39:56.489Z", "date_only": false, "value": "2026-10-16T17:39:56.489Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111704", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:39:56.489Z", "date_only": false, "value": "2026-10-16T17:39:56.489Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111704", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:54Z", "date_only": false, "value": "2026-10-16T18:17:54Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HGQJ-CHVW-C4P5", "record": "GHSA-HGQJ-CHVW-C4P5", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:54.370Z", "date_only": false, "value": "2026-10-16T18:17:54.370", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111704", "record": "FKIE_CVE-2026-111704", "field": "published"}, {"timestamp": "2026-10-16T18:34:54Z", "date_only": false, "value": "2026-10-16T18:34:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HGQJ-CHVW-C4P5", "record": "GHSA-HGQJ-CHVW-C4P5", "field": "published"}, {"timestamp": "2026-10-16T18:34:54Z", "date_only": false, "value": "2026-10-16T18:34:54Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HGQJ-CHVW-C4P5", "record": "GHSA-HGQJ-CHVW-C4P5", "field": "modified"}, {"timestamp": "2026-10-16T18:56:24.297Z", "date_only": false, "value": "2026-10-16T18:56:24.297745Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452110810791940", "record": "CVE-2026-111704", "field": "creation_timestamp", "uuid": "24fc12c8-1f3c-4b75-adbb-a4e2f7708110", "content": "CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111704https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposurehttps://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/service/impl/AuthServiceImpl.java#L51-L58https://www.vulncheck.com/advisories/langchat-through-commit-2a6285a-missing-authentication-on-rest-api-controllers#LangChat #langchat#CVE_2026_111704#bot", "url": "https://infosec.exchange/users/cve/statuses/117452110810791940"}, {"timestamp": "2026-10-16T19:03:18.127Z", "date_only": false, "value": "2026-10-16T19:03:18.127", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111704", "record": "FKIE_CVE-2026-111704", "field": "lastModified"}, {"timestamp": "2026-10-16T20:09:59.966Z", "date_only": false, "value": "2026-10-16T20:09:59.966598Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzezuwy7x2l", "record": "CVE-2026-111704", "field": "creation_timestamp", "uuid": "4ab1e97e-6de7-472c-a178-ebf2d1424a72", "content": "\ud83d\udea8 CVE-2026-111704 \u2014 CVSS 9.3 CRITICAL\n\nLangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111704\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzezuwy7x2l"}, {"timestamp": "2026-10-16T21:10:04.536Z", "date_only": false, "value": "2026-10-16T21:10:04.536236Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzifc5kbh27", "record": "CVE-2026-111704", "field": "creation_timestamp", "uuid": "0fab04d6-239b-4980-9ceb-62f86223d55e", "content": "CVE-2026-111704 - langchat\nThe LangChat software does not check who is calling its web services, so anyone on the internet can directly use the API endpoints. Through these endpoints an attacker could view\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#langchat #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzifc5kbh27"}, {"timestamp": "2026-10-17T07:30:25.232Z", "date_only": false, "value": "2026-10-17T07:30:25.232453Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117455075703953552", "record": "CVE-2026-111704", "field": "creation_timestamp", "uuid": "662fb340-6adb-4cec-bfd0-c20f71441f82", "content": "CVE-2026-111704: LangChat (\u2264commit 2a6285a) is affected by a CRITICAL missing authentication flaw (CVSS 9.8). Unauthenticated attackers can access REST APIs, read user credentials, and escalate privileges. Patch status unconfirmed. https://radar.offseq.com/threat/langchat-through-commit-2a6285a-contains-a-missing-authentication-vulnerability-that-allows-89fa6c1030988aed #OffSeq #Vuln #LangChat", "url": "https://infosec.exchange/users/offseq/statuses/117455075703953552"}, {"timestamp": "2026-10-20T13:38:00.932Z", "date_only": false, "value": "2026-10-20T13:38:00.932139Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117473507998206107", "record": "CVE-2026-111704", "field": "creation_timestamp", "uuid": "96bb5e24-abad-45e4-a655-dc7ecf6e7f9e", "content": "Go hack more sev:CRIT AI shit.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111693\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111704\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96620\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105192\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109437", "url": "https://infosec.exchange/users/cR0w/statuses/117473507998206107"}]}