CVE-2026-25528
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceLangSmith Client SDKs for Python and JavaScript have an SSRF vulnerability in their distributed tracing feature. The RunTree.from_headers() (Python) and RunTree.fromHeaders() (TypeScript) methods accept attacker-controlled api_url values from the HTTP baggage header without validation, allowing attackers to inject malicious replica URLs. When traced operations complete, the SDK sends sensitive trace data to all configured replica URLs—including attacker-specified ones via the post() and patch() methods.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify LangSmith SDK usage in your projectCheck your Python requirements.txt, pyproject.toml, or JavaScript package.json for langsmith or langsmith-sdk packagesAffected if The langsmith or langsmith-sdk package is present in your dependencies
-
Determine the installed LangSmith SDK versionRun 'pip show langsmith' for Python or 'npm list langsmith' for JavaScript to see the installed version numberAffected if The installed version is earlier than 0.6.3 (Python) or 0.4.6 (JavaScript)
-
Check if distributed tracing is enabledSearch your codebase for usage of RunTree.from_headers() (Python) or RunTree.fromHeaders() (TypeScript) method calls, or look for tracing configuration that reads headersAffected if Your code calls from_headers() or fromHeaders() to process HTTP headers from incoming requests
-
Verify if your application processes external HTTP headersReview whether your application accepts and processes HTTP headers from untrusted sources (such as user-facing web servers, API gateways, or any endpoint that handles requests from external clients)Affected if Your application passes incoming HTTP headers to LangSmith's tracing methods without filtering the baggage header
You are affected if your application uses a LangSmith SDK version before 0.6.3 (Python) or 0.4.6 (JavaScript) and processes HTTP headers from untrusted sources using the from_headers() or fromHeaders() methods.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to LangSmith Python SDK version 0.6.3 or JavaScript SDK version 0.4.6 or later, which implement validation of the api_url parameter from the baggage header.
Python SDK: upgrade to langsmith version 0.6.3; JavaScript SDK: upgrade to @langchain/langsmith-sdk version 0.4.6
- Identify which LangSmith SDK(s) are in use: Python (langsmith package) and/or JavaScript/TypeScript (@langchain/langsmith-sdk
- For Python: Run 'pip show langsmith' to check current version, then run 'pip install --upgrade langsmith==0.6.3' to upgrade to the fixed version
- For JavaScript/TypeScript: Run 'npm list @langchain/langsmith-sdk' to check current version, then run 'npm install @langchain/[email protected]' to upgrade to the fixed version
- Verify the upgrade was successful by checking the installed version matches the fixed release
- Ensure any applications or services using the SDK are restarted to load the patched version
- Review application logs after upgrade to confirm the SDK is functioning correctly with the new version
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,328.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-25528 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-25528 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data