Server-Side Request Forgery (SSRF)Weakness · CWE-918

CVE-2026-25528

MEDIUM · 5.8 CVSS v3.1 Published 2026-02-09
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
67/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

LangSmith Client SDKs for Python and JavaScript have an SSRF vulnerability in their distributed tracing feature. The RunTree.from_headers() (Python) and RunTree.fromHeaders() (TypeScript) methods accept attacker-controlled api_url values from the HTTP baggage header without validation, allowing attackers to inject malicious replica URLs. When traced operations complete, the SDK sends sensitive trace data to all configured replica URLs—including attacker-specified ones via the post() and patch() methods.

MitigationUpgrade to LangSmith Python SDK version 0.6.3 or JavaScript SDK version 0.4.6 or later, which implement validation of the api_url parameter from the baggage header.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify LangSmith SDK usage in your project
    Check your Python requirements.txt, pyproject.toml, or JavaScript package.json for langsmith or langsmith-sdk packages
    Affected if The langsmith or langsmith-sdk package is present in your dependencies
  2. Determine the installed LangSmith SDK version
    Run 'pip show langsmith' for Python or 'npm list langsmith' for JavaScript to see the installed version number
    Affected if The installed version is earlier than 0.6.3 (Python) or 0.4.6 (JavaScript)
  3. Check if distributed tracing is enabled
    Search your codebase for usage of RunTree.from_headers() (Python) or RunTree.fromHeaders() (TypeScript) method calls, or look for tracing configuration that reads headers
    Affected if Your code calls from_headers() or fromHeaders() to process HTTP headers from incoming requests
  4. Verify if your application processes external HTTP headers
    Review whether your application accepts and processes HTTP headers from untrusted sources (such as user-facing web servers, API gateways, or any endpoint that handles requests from external clients)
    Affected if Your application passes incoming HTTP headers to LangSmith's tracing methods without filtering the baggage header

You are affected if your application uses a LangSmith SDK version before 0.6.3 (Python) or 0.4.6 (JavaScript) and processes HTTP headers from untrusted sources using the from_headers() or fromHeaders() methods.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade to LangSmith Python SDK version 0.6.3 or JavaScript SDK version 0.4.6 or later, which implement validation of the api_url parameter from the baggage header.

Recommended fix High confidence

Python SDK: upgrade to langsmith version 0.6.3; JavaScript SDK: upgrade to @langchain/langsmith-sdk version 0.4.6

  1. Identify which LangSmith SDK(s) are in use: Python (langsmith package) and/or JavaScript/TypeScript (@langchain/langsmith-sdk
  2. For Python: Run 'pip show langsmith' to check current version, then run 'pip install --upgrade langsmith==0.6.3' to upgrade to the fixed version
  3. For JavaScript/TypeScript: Run 'npm list @langchain/langsmith-sdk' to check current version, then run 'npm install @langchain/[email protected]' to upgrade to the fixed version
  4. Verify the upgrade was successful by checking the installed version matches the fixed release
  5. Ensure any applications or services using the SDK are restarted to load the patched version
  6. Review application logs after upgrade to confirm the SDK is functioning correctly with the new version
Caveat No breaking changes mentioned in the advisory; the fix adds validation for incoming header values without altering existing API behavior

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing4.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,080
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,328.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-25528 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-25528 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data