DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-2G6R-C272-W58R: CVE-2026-26013: Server-Side Request Forgery in LangChain Image Token Counting

#security #cve #cybersecurity

CVE-2026-26013: Server-Side Request Forgery in LangChain Image Token Counting

Vulnerability ID: GHSA-2G6R-C272-W58R
CVSS Score: 3.7
Published: 2026-02-11

Prior to version 1.2.11, the LangChain LLM framework is affected by a Server-Side Request Forgery (SSRF) vulnerability inside its image token counting mechanism. Specifically, the ChatOpenAI.get_num_tokens_from_messages() method retrieves arbitrary image_url values from user prompts without validating the destination host or IP address. Attackers can exploit this issue to scan internal infrastructure, access local services, or harvest credentials from cloud metadata services.

TL;DR

Unvalidated image fetches during token counting in LangChain allow attackers to perform Server-Side Request Forgery (SSRF) against internal endpoints and cloud metadata services.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS Severity Score: 3.7 (Low)
  • EPSS Score: 0.00379 (Percentile: 30.21%)
  • Exploit Status: PoC (Proof of Concept) available
  • CISA KEV Status: Not Listed
  • Ransomware Use: No

Affected Systems

  • LangChain Core (langchain-core)
  • LangChain OpenAI Integration (langchain-openai)
  • langchain-core: < 1.2.11 (Fixed in: 1.2.11)
  • langchain-openai: < 1.2.11 (Fixed in: 1.2.11)

Code Analysis

Commit: 2b4b1dc

Implement SSRF protection logic and restrict image URLs during token calculation in get_num_tokens_from_messages

Exploit Details

  • GitHub: Official Security Advisory containing proof-of-concept conditions and technical details

Mitigation Strategies

  • Upgrade the langchain-core package to version 1.2.11 or later to enable the built-in validation filters.
  • Manually disable remote image fetching for token calculation within ChatOpenAI instances by passing allow_fetching_images=False.
  • Implement network egress filtering rules to block outbound connections from application containers to private networks and the link-local address 169.254.169.254.
  • Deploy localized web application firewalls to parse incoming prompts and block elements containing restricted URL patterns before they reach the LLM framework.

Remediation Steps:

  1. Execute pip install -U langchain-core>=1.2.11 langchain-openai>=0.1.0 to upgrade the environment packages.
  2. Update application instantiation code to pass the explicit parameter: chat_model.get_num_tokens_from_messages(messages, allow_fetching_images=False).
  3. Verify the resolution boundaries by attempting to supply an image URL pointing to localhost and validating that the appropriate ValueError is caught and logged.
  4. Implement infrastructure-level security groups to completely block instance metadata connections if the application does not explicitly require them.

References

Read the full report for GHSA-2G6R-C272-W58R on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)