CVE-2026-41488 angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
Attackers can bypass SSRF protections in LangChain OpenAI via DNS rebinding to access internal network resources during image token counting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41488?
CVE-2026-41488 is a low-severity server-side request forgery vulnerability in langchain-ai langchain-openai, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
Weakness: CWE-918
Which versions are affected by CVE-2026-41488?
3 open source packages ship an affected version, including langchain-openai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langchain-openai PyPI | All versions | 1.1.14 |
langchain-openai PyPI | All versions | 1.1.14 |
langchain-openai PyPI | All versions | 1.1.14 |
Products include Langchain Langchain-Openai.
How do I fix CVE-2026-41488?
Upgrade langchain-openai to 1.1.14 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-41488 being exploited?
There is no known exploitation of CVE-2026-41488 in the wild and no public exploit code.
Sources
Also known as ECHO-7a3a-0a91-96a1, GHSA-r7w7-9xr2-qq2r, PYSEC-2026-76.