CVE-2026-26013 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
Attackers can trigger Server-Side Request Forgery in LangChain by providing malicious image URLs during token counting, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26013?
CVE-2026-26013 is a low-severity server-side request forgery vulnerability in langchain-ai langchain, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.
Weakness: CWE-918
Which versions are affected by CVE-2026-26013?
3 open source packages ship an affected version, including langchain-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langchain-core PyPI | All versions | 1.2.11 |
langchain-core PyPI | All versions | 1.2.11 |
langchain-core PyPI | All versions | 1.2.11 |
Products include Langchain Langchain Core.
How do I fix CVE-2026-26013?
Upgrade langchain-core to 1.2.11 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-26013 being exploited?
There is no known exploitation of CVE-2026-26013 in the wild and no public exploit code.
Other vulnerabilities in langchain-ai langchain
Sources
Also known as ECHO-dbfc-d3ff-9463, GHSA-2g6r-c272-w58r, PYSEC-2026-2562.