CVE-2026-25528

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25528", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T19:59:47.373Z", "datePublished": "2026-02-09T20:08:32.903Z", "dateUpdated": "2026-02-10T15:59:49.992Z"}, "containers": {"cna": {"title": "LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p"}], "affected": [{"vendor": "langchain-ai", "product": "langsmith-sdk", "versions": [{"version": ">= 0.4.10, <0.6.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T20:08:32.903Z"}, "descriptions": [{"lang": "en", "value": "LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK."}], "source": {"advisory": "GHSA-v34v-rq6j-cj6p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:39:48.039907Z", "id": "CVE-2026-25528", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:59:49.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25528", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:39:48.039907Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:39:48.719Z"}}], "cna": {"title": "LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection", "source": {"advisory": "GHSA-v34v-rq6j-cj6p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "langchain-ai", "product": "langsmith-sdk", "versions": [{"status": "affected", "version": ">= 0.4.10, <0.6.3"}]}], "references": [{"url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p", "name": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T20:08:32.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25528", "state": "PUBLISHED", "dateUpdated": "2026-02-10T15:59:49.992Z", "dateReserved": "2026-02-02T19:59:47.373Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T20:08:32.903Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "langsmith-sdk", "vendor": "langchain-ai", "versions": [{"status": "affected", "version": ">= 0.4.10, <0.6.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK."}, {"lang": "es", "value": "Los SDKs del cliente de LangSmith proporcionan SDKs para interactuar con la plataforma LangSmith. La caracter\u00edstica de trazado distribuido del SDK de LangSmith es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor a trav\u00e9s de encabezados HTTP maliciosos. Un atacante puede inyectar valores arbitrarios de api_url a trav\u00e9s del encabezado 'baggage', haciendo que el SDK exfiltre datos de traza sensibles a puntos finales controlados por el atacante. Al usar el trazado distribuido, el SDK analiza los encabezados HTTP entrantes a trav\u00e9s de RunTree.from_headers() en Python o RunTree.fromHeaders() en Typescript. El encabezado 'baggage' puede contener configuraciones de r\u00e9plica, incluyendo los campos api_url y api_key. Antes de la correcci\u00f3n, estos valores controlados por el atacante eran aceptados sin validaci\u00f3n. Cuando una operaci\u00f3n trazada se completa, los m\u00e9todos post() y patch() del SDK env\u00edan datos de ejecuci\u00f3n a todas las URLs de r\u00e9plica configuradas, incluyendo cualquiera inyectada por un atacante. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.6.3 del SDK de Python y 0.4.6 del SDK de JavaScript."}], "id": "CVE-2026-25528", "lastModified": "2026-06-17T10:24:47.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25528", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:39:48.039907Z", "version": "2.0.3"}}]}, "published": "2026-02-09T21:15:48.857", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/langchain-ai/langsmith-sdk/security/advisories/GHSA-v34v-rq6j-cj6p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.10,0.6.3)"}}], "product": "langsmith-sdk", "vendor": "langchain-ai"}], "analysis": {"en": {"generated_at": "2026-04-17T21:15:00.498991+00:00", "value": {"mitigation_remediation": ["Upgrade the Python SDK to version 0.6.3 or newer.", "Upgrade the JavaScript SDK to version 0.4.6 or newer.", "If an upgrade is not yet possible, disable distributed tracing in the SDK configuration to prevent the vulnerability from being exercised."], "summary": {"action": "Apply Patch", "impact": "Confidentiality breach via SSRF"}, "threat_synthesis": {"affected_systems": "Affected products are the LangSmith client SDKs provided by langchain-ai for Python and JavaScript. Versions prior to 0.6.3 for Python and prior to 0.4.6 for JavaScript are impacted. The flaw exists in the RunTree.from_headers() (Python) and RunTree.fromHeaders() (Typescript) code used when distributed tracing is enabled.", "description_and_impact": "The vulnerability is a server\u2011side request forgery in the LangSmith client SDK\u2019s distributed tracing feature. An attacker can inject malicious values into the baggage HTTP header, specifically the api_url field, which the SDK parses without validation. When a traced operation completes, the SDK sends run data to all configured replica URLs. If an attacker supplies an arbitrary api_url, trace data, including potentially sensitive information, is exfiltrated to the attacker\u2019s endpoint. This results in a confidentiality compromise of trace data.", "risk_and_exploitability": "The CVSS score is 5.8, indicating medium severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is via a client that has network access to the LangSmith service; an attacker who can influence the baggage header sent to the SDK can cause it to contact arbitrary endpoints, leading to data exfiltration. Exploitation requires the SDK to be running with distributed tracing enabled and the attacker to supply a malicious api_url in the baggage header. No known workarounds are available beyond disabling distributed tracing."}}}}, "created": "2026-02-10T11:35:14.782286+00:00", "updated": "2026-04-17T21:15:27.392387+00:00", "vendors": ["langchain-ai", "langchain-ai$PRODUCT$langsmith-sdk"]}