{"uuid": "ac4a6752-7715-4f74-b633-dbcee6a3ca58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-26013", "type": "seen", "source": "https://gist.github.com/alon710/2d7287fc0fc036130011004bd90ef758", "content": "# GHSA-2G6R-C272-W58R: CVE-2026-26013: Server-Side Request Forgery in LangChain Image Token Counting\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-02-11\n> **Full Report:** https://cvereports.com/reports/GHSA-2G6R-C272-W58R\n\n## Summary\nPrior to version 1.2.11, the LangChain LLM framework is affected by a Server-Side Request Forgery (SSRF) vulnerability inside its image token counting mechanism. Specifically, the ChatOpenAI.get_num_tokens_from_messages() method retrieves arbitrary image_url values from user prompts without validating the destination host or IP address. Attackers can exploit this issue to scan internal infrastructure, access local services, or harvest credentials from cloud metadata services.\n\n## TL;DR\nUnvalidated image fetches during token counting in LangChain allow attackers to perform Server-Side Request Forgery (SSRF) against internal endpoints and cloud metadata services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Severity Score**: 3.7 (Low)\n- **EPSS Score**: 0.00379 (Percentile: 30.21%)\n- **Exploit Status**: PoC (Proof of Concept) available\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- LangChain Core (langchain-core)\n- LangChain OpenAI Integration (langchain-openai)\n- **langchain-core**: < 1.2.11 (Fixed in: `1.2.11`)\n- **langchain-openai**: < 1.2.11 (Fixed in: `1.2.11`)\n\n## Mitigation\n\n- Upgrade the langchain-core package to version 1.2.11 or later to enable the built-in validation filters.\n- Manually disable remote image fetching for token calculation within ChatOpenAI instances by passing allow_fetching_images=False.\n- Implement network egress filtering rules to block outbound connections from application containers to private networks and the link-local address 169.254.169.254.\n- Deploy localized web application firewalls to parse incoming prompts and block elements containing restricted URL patterns before they reach the LLM framework.\n\n**Remediation Steps:**\n1. Execute pip install -U langchain-core>=1.2.11 langchain-openai>=0.1.0 to upgrade the environment packages.\n2. Update application instantiation code to pass the explicit parameter: chat_model.get_num_tokens_from_messages(messages, allow_fetching_images=False).\n3. Verify the resolution boundaries by attempting to supply an image URL pointing to localhost and validating that the appropriate ValueError is caught and logged.\n4. Implement infrastructure-level security groups to completely block instance metadata connections if the application does not explicitly require them.\n\n## References\n\n- [GitHub Advisory: SSRF via image_url token counting](https://github.com/langchain-ai/langchain/security/advisories/GHSA-2g6r-c272-w58r)\n- [NVD - CVE-2026-26013](https://nvd.nist.gov/vuln/detail/CVE-2026-26013)\n- [Wiz Vulnerability Database Details on CVE-2026-26013](https://www.wiz.io/vulnerability-database/cve/cve-2026-26013)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-2G6R-C272-W58R) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T03:31:30.971943Z"}