LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

An attacker can exploit this SSRF vulnerability by injecting malicious image URLs into user input. While the vulnerability is classified as low severity, it can still pose risks. The attacker cannot directly view the responses from the SSRF requests (blind SSRF), limiting immediate data exfiltration. However, repeated requests could potentially lead to resource exhaustion due to the 5-second timeout. The primary risk lies in the potential for internal network scanning and reconnaissance, allowing an attacker to map the internal network and identify other potential targets. This vulnerability shares similarities with other SSRF vulnerabilities where attackers leverage server-side requests to probe internal systems.

1. 已保留2026-02-09
2. 发布日期2026-02-11
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-26013 is to upgrade Langchain-Core to version 1.2.11 or later. If upgrading immediately is not feasible, consider implementing input validation on the image_url parameter to restrict allowed protocols and domains. A Web Application Firewall (WAF) configured to block requests to suspicious URLs or internal IP addresses can provide an additional layer of defense. Monitor network traffic for unusual outbound requests originating from your Langchain-Core instances. After upgrading, confirm the fix by attempting to submit a crafted image URL containing an internal IP address and verifying that the request is blocked or times out.