LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019). Users should upgrade to `@langchain/community` 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating `Location` targets before following them. In this version, automatic redirects are disabled (`redirect: "manual"`), each 3xx `Location` is resolved and validated with `validateSafeUrl()` before the next request, and a maximum redirect limit prevents infinite loops.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| langchain-ai | langchainjs | before 1.1.18 | 1.1.18 | Patch available | CNA |
| — | @langchain/community (npm) | before 1.1.18 | 1.1.18 | Patch available | GHSA-mphv-75cg-56wg |
- langchainjs Vendorlangchain-ai Affected before 1.1.18 Fixed in 1.1.18 Patch available CNA
- @langchain/community (npm) Vendor— Affected before 1.1.18 Fixed in 1.1.18 Patch available GHSA-mphv-75cg-56wg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:langchain:langchain_community:*:*:*:*:*:node.js:*:* | before 1.1.18 | Vulnerable | langchain-ai |
- cpe:2.3:a:langchain:langchain_community:*:*:*:*:*:node.js:*:* Versions before 1.1.18 Vulnerable ·langchain-ai
Remediation
- Fix · CNA langchainjs (langchain-ai) Fixed in 1.1.18
- Fix · GHSA-mphv-75cg-56wg @langchain/community (npm) Fixed in 1.1.18 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27795
- 2026-10-03 Alias added: GHSA-mphv-75cg-56wg
References
Patch 2
Advisory 2
Other 5
- https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
- https://github.com/langchain-ai/langchainjs/pull/9990
- https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
- https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18
- https://github.com/langchain-ai/langchainjs
More langchain-ai Langchain Community vulnerabilities
- TI-2026-21033 @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation CVSS 3.1MEDIUM 4.1
Sources
- CVE-2026-27795 · CVE Program
- CVE-2026-27795 · NVD
- FIRST EPSS
- GHSA-mphv-75cg-56wg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-27795 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences