CVE-2026-25750

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25750", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T18:35:52.356Z", "datePublished": "2026-03-04T21:58:59.119Z", "dateUpdated": "2026-03-05T15:42:21.213Z"}, "containers": {"cna": {"title": "LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/langchain-ai/helm/security/advisories/GHSA-r8wq-jwgw-p74g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langchain-ai/helm/security/advisories/GHSA-r8wq-jwgw-p74g"}], "affected": [{"vendor": "langchain-ai", "product": "helm", "versions": [{"version": "< 0.12.71", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T21:58:59.119Z"}, "descriptions": [{"lang": "en", "value": "Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentication tokens. The vulnerability affected both LangSmith Cloud and self-hosted deployments. Authenticated LangSmith users who clicked on a specially crafted malicious link would have their bearer token, user ID, and workspace ID transmitted to an attacker-controlled server. With this stolen token, an attacker could impersonate the victim and access any LangSmith resources or perform any actions the user was authorized to perform within their workspace. The attack required social engineering (phishing, malicious links in emails or chat applications) to convince users to click the crafted URL. The stolen tokens expired after 5 minutes, though repeated attacks against the same user were possible if they could be convinced to click malicious links multiple times. The fix in version 0.12.71 implements validation requiring user-defined allowed origins for the baseUrl parameter, preventing tokens from being sent to unauthorized servers. No known workarounds are available. Self-hosted customers must upgrade to the patched version."}], "source": {"advisory": "GHSA-r8wq-jwgw-p74g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:39:31.562876Z", "id": "CVE-2026-25750", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:42:21.213Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25750", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:39:31.562876Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:39:32.603Z"}}], "cna": {"title": "LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl", "source": {"advisory": "GHSA-r8wq-jwgw-p74g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "langchain-ai", "product": "helm", "versions": [{"status": "affected", "version": "< 0.12.71"}]}], "references": [{"url": "https://github.com/langchain-ai/helm/security/advisories/GHSA-r8wq-jwgw-p74g", "name": "https://github.com/langchain-ai/helm/security/advisories/GHSA-r8wq-jwgw-p74g", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentication tokens. The vulnerability affected both LangSmith Cloud and self-hosted deployments. Authenticated LangSmith users who clicked on a specially crafted malicious link would have their bearer token, user ID, and workspace ID transmitted to an attacker-controlled server. With this stolen token, an attacker could impersonate the victim and access any LangSmith resources or perform any actions the user was authorized to perform within their workspace. The attack required social engineering (phishing, malicious links in emails or chat applications) to convince users to click the crafted URL. The stolen tokens expired after 5 minutes, though repeated attacks against the same user were possible if they could be convinced to click malicious links multiple times. The fix in version 0.12.71 implements validation requiring user-defined allowed origins for the baseUrl parameter, preventing tokens from being sent to unauthorized servers. No known workarounds are available. Self-hosted customers must upgrade to the patched version."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T21:58:59.119Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25750", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:42:21.213Z", "dateReserved": "2026-02-05T18:35:52.356Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-04T21:58:59.119Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "helm", "vendor": "langchain-ai", "versions": [{"status": "affected", "version": "< 0.12.71"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:langchain:langsmith:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "5439C5E6-0075-46D6-A73C-E68084862FD0", "versionEndExcluding": "0.12.71", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentication tokens. The vulnerability affected both LangSmith Cloud and self-hosted deployments. Authenticated LangSmith users who clicked on a specially crafted malicious link would have their bearer token, user ID, and workspace ID transmitted to an attacker-controlled server. With this stolen token, an attacker could impersonate the victim and access any LangSmith resources or perform any actions the user was authorized to perform within their workspace. The attack required social engineering (phishing, malicious links in emails or chat applications) to convince users to click the crafted URL. The stolen tokens expired after 5 minutes, though repeated attacks against the same user were possible if they could be convinced to click malicious links multiple times. The fix in version 0.12.71 implements validation requiring user-defined allowed origins for the baseUrl parameter, preventing tokens from being sent to unauthorized servers. No known workarounds are available. Self-hosted customers must upgrade to the patched version."}, {"lang": "es", "value": "Langchain Helm Charts son gr\u00e1ficos Helm para desplegar aplicaciones Langchain en Kubernetes. Antes de la versi\u00f3n 0.12.71 de langchain-ai/helm, exist\u00eda una vulnerabilidad de inyecci\u00f3n de par\u00e1metros URL en LangSmith Studio que podr\u00eda permitir el acceso no autorizado a cuentas de usuario a trav\u00e9s de tokens de autenticaci\u00f3n robados. La vulnerabilidad afect\u00f3 tanto a LangSmith Cloud como a las implementaciones autoalojadas. Usuarios de LangSmith autenticados que hicieron clic en un enlace malicioso especialmente dise\u00f1ado ver\u00edan su token de portador, ID de usuario e ID de espacio de trabajo transmitidos a un servidor controlado por el atacante. Con este token robado, un atacante podr\u00eda suplantar a la v\u00edctima y acceder a cualquier recurso de LangSmith o realizar cualquier acci\u00f3n que el usuario estuviera autorizado a realizar dentro de su espacio de trabajo. El ataque requiri\u00f3 ingenier\u00eda social (phishing, enlaces maliciosos en correos electr\u00f3nicos o aplicaciones de chat) para convencer a los usuarios de hacer clic en la URL dise\u00f1ada. Los tokens robados expiraban despu\u00e9s de 5 minutos, aunque eran posibles ataques repetidos contra el mismo usuario si se les pod\u00eda convencer de hacer clic en enlaces maliciosos varias veces. La correcci\u00f3n en la versi\u00f3n 0.12.71 implementa una validaci\u00f3n que requiere or\u00edgenes permitidos definidos por el usuario para el par\u00e1metro baseUrl, evitando que los tokens sean enviados a servidores no autorizados. No hay soluciones alternativas conocidas disponibles. Los clientes autoalojados deben actualizar a la versi\u00f3n parcheada."}], "id": "CVE-2026-25750", "lastModified": "2026-06-17T10:25:10.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25750", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:39:31.562876Z", "version": "2.0.3"}}]}, "published": "2026-03-04T22:16:17.667", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/langchain-ai/helm/security/advisories/GHSA-r8wq-jwgw-p74g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.12.71)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "helm", "source": "cna", "vendor": "langchain-ai"}, "product": "helm", "vendor": "langchain-ai"}], "analysis": {"en": {"generated_at": "2026-04-16T13:05:34.707501+00:00", "value": {"mitigation_remediation": ["Update the Helm chart to version 0.12.71 or later to apply the validation that restricts the baseUrl parameter to allowed origins.", "In the updated Helm configuration, explicitly define the allowed origins for baseUrl to limit the destinations that can receive bearer tokens.", "Verify that self\u2011hosted deployments are using the patched chart and that no old values remain in the deployment configuration."], "summary": {"action": "Patch Now", "impact": "Token theft via URL parameter injection"}, "threat_synthesis": {"affected_systems": "The issue exists in deployments that use the langchain\u2011ai Helm charts for LangSmith on Kubernetes prior to chart version 0.12.71. Both the cloud\u2011based and self\u2011hosted instances of LangSmith Studio are impacted. The vulnerability surfaces in any hosting environment where the Helm chart version is older than the patched release.", "description_and_impact": "LangSmith Studio is vulnerable to a URL parameter injection flaw that allows an attacker to embed a malicious baseUrl in a link. When an authenticated user clicks the link, the vulnerable application transmits the user's bearer token, user ID, and workspace ID to the attacker-controlled server. This leads to immediate impersonation of the victim within the affected workspace. The flaw is a classic example of input validation weakness (CWE\u201174).", "risk_and_exploitability": "The CVSS score of 8.5 classifies this as high\u2011severity. EPSS is below 1\u202f%, indicating a low probability of exploitation under current conditions, and the flaw is not yet listed in the CISA KEV catalog. However, successful attacks require only social engineering to entice a user to click a crafted link, a common vector in phishing campaigns. Tokens are short\u2011lived, expiring after five minutes, but repeated social engineering could repeatedly harvest them. Once captured, an attacker can perform any action that the victim was authorized to execute within the workspace."}}}}, "created": "2026-03-05T09:05:38.982564+00:00", "updated": "2026-04-16T13:15:06.222556+00:00", "vendors": ["langchain-ai", "langchain-ai$PRODUCT$helm"]}