CVE-2026-26013
published 2026-02-10CVE-2026-26013: LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches…
PriorityP419low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.38%
29.7th percentile
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| langchain-ai | langchain | < 1.2.11 | 1.2.11 |
| langchain | langchain_core | < 1.2.11 | 1.2.11 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
osv·2026-02-11
CVE-2026-26013 [LOW] LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
## Server-Side Request Forgery (SSRF) in ChatOpenAI Image Token Counting
### Summary
The `ChatOpenAI.get_num_tokens_from_messages()` method fetches arbitrary `image_url` values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input.
### Severity
**Low** - The vulnerability allows SSRF attacks but has limited impact due to:
- Responses are not returned to the attacker (blind SSRF)
- Default 5-second timeout limits resource exhaustion
- Non-image responses fail at PIL image parsing
### Impact
An attacker who can control image URLs passed to `get_num_
GHSA
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
ghsa·2026-02-11
CVE-2026-26013 [LOW] CWE-918 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
## Server-Side Request Forgery (SSRF) in ChatOpenAI Image Token Counting
### Summary
The `ChatOpenAI.get_num_tokens_from_messages()` method fetches arbitrary `image_url` values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input.
### Severity
**Low** - The vulnerability allows SSRF attacks but has limited impact due to:
- Responses are not returned to the attacker (blind SSRF)
- Default 5-second timeout limits resource exhaustion
- Non-image responses fail at PIL image parsing
### Impact
An attacker who can control image URLs passed to `get_num_
Red Hat
langchain: SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
vendor_redhat·2026-02-10·CVSS 3.7
CVE-2026-26013 [LOW] CWE-918 langchain: SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
langchain: SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.
A flaw was found in LangChain. The ChatOpenAI.get_num_tokens_from_messages method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This issue allows an attacker to cause Server-Side Request Forgery (SSRF) by providing malicious imag
No detection rules found.
No public exploits indexed.
2026-02-10
Published