5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25528

CVE-2026-25528: LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() in Python or RunTree.fromHeaders() in Typescript. The baggage header can contain replica configurations including api_url and api_key fields. Prior to the fix, these attacker-controlled values were accepted without validation. When a traced operation completes, the SDK's post() and patch() methods send run data to all configured replica URLs, including any injected by an attacker. This vulnerability is fixed in version 0.6.3 of the Python SDK and 0.4.6 of the JavaScript SDK.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25528

CVE-2026-25528:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langsmith	pip	>= 0.4.10, < 0.6.3	0.6.3
langsmith	npm	>= 0.3.41, < 0.4.6	0.4.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the LangSmith SDK for both Python and JavaScript/TypeScript. The root cause is the improper validation of the baggage HTTP header when creating a distributed tracing context. The RunTree.from_headers (Python) and RunTree.fromHeaders (JS/TS) methods were identified as the vulnerable entry points.

An attacker could send an HTTP request to a service using the vulnerable SDK, including a specially crafted baggage header. This header could specify a langsmith-replicas value containing a malicious api_url. The SDK would parse this header and configure itself to send trace data to the attacker's specified URL.

The patch, identified in commit c8d91099d5546611909b45a04251fba44083025a, rectifies this by introducing an allowlist of safe fields (_HEADER_SAFE_REPLICA_FIELDS) that can be processed from the replica configuration. The code was modified to explicitly filter out sensitive fields like api_url and api_key before they are used, thus preventing the SSRF and data exfiltration. The analysis of the patch files confirms that the logic was changed in python/langsmith/run_trees.py for the Python SDK and js/src/run_trees.ts for the JavaScript SDK.

Vulnerable functions

RunTree.from_headers

python/langsmith/run_trees.py

The `RunTree.from_headers` class method is used to initialize a tracing context from incoming HTTP headers. It internally uses `_Baggage.from_header` to parse the `baggage` header. The vulnerability lies in the fact that, prior to the patch, this method would accept and use `api_url` and `api_key` fields from the `baggage` header's `langsmith-replicas` value. This allowed an attacker to inject a malicious URL, causing the SDK to send sensitive trace data to an attacker-controlled endpoint (SSRF). The patch introduces `_filter_replica_for_headers` to strip these sensitive fields.

RunTree.fromHeaders

js/src/run_trees.ts

The `RunTree.fromHeaders` static method initializes a tracing context from HTTP headers in the JavaScript/TypeScript SDK. It creates a `Baggage` object, whose constructor was vulnerable. The constructor would parse the `baggage` header and, if it contained `langsmith-replicas`, would insecurely accept `apiUrl` and `apiKey` fields. This allowed an attacker to specify a malicious endpoint for trace data exfiltration (SSRF). The patch adds the `filterReplicaForHeaders` function to sanitize the replica configuration, removing the dangerous fields.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.