3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26013

CVE-2026-26013: LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26013

CVE-2026-26013:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langchain-core	pip	< 1.2.11	1.2.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) within the langchain-openai package. It occurs when calculating the token count for messages containing image URLs. The public method ChatOpenAI.get_num_tokens_from_messages processes these messages and, for high-detail images, calls the internal helper function _url_to_size. Prior to the patch, _url_to_size would fetch the provided image URL using httpx.get() without any validation. This allowed an attacker to craft a message with a malicious image_url pointing to an internal service or cloud metadata endpoint, forcing the server to make a request to that URL. The patch, identified in commit 2b4b1dc29a833d4053deba4c2b77a3848c834565, rectifies this by adding a call to a new validate_safe_url function within _url_to_size. This new function ensures the URL is not pointing to private IP ranges or known cloud metadata endpoints before any request is made. Therefore, a runtime profile exploiting this vulnerability would show calls originating from ChatOpenAI.get_num_tokens_from_messages leading to the unsafe request in _url_to_size.

Vulnerable functions

ChatOpenAI.get_num_tokens_from_messages

libs/partners/openai/langchain_openai/chat_models/base.py

This is the public API method that receives user-controlled message content, including malicious `image_url` values. It then calls the `_url_to_size` function with the untrusted URL, which triggers the SSRF vulnerability.

_url_to_size

libs/partners/openai/langchain_openai/chat_models/base.py

This internal function is the core of the vulnerability. In the vulnerable version, it directly makes an HTTP GET request to the `image_source` URL without any validation, allowing an attacker to perform a Server-Side Request Forgery (SSRF) attack. The patch removes this direct call and replaces it with a call that includes security validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.