CVE-2025-2828: LangChain RequestsToolkit: SSRF exposes cloud metadata

Q: Is CVE-2025-2828 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-2828, increasing the risk of exploitation.

Q: How to fix CVE-2025-2828?

1. PATCH: Upgrade langchain-community to ≥0.0.28 immediately — patch is available and targeted. 2. NETWORK: Block egress from agent hosts to 169.254.169.254 (IMDS), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 via firewall/security groups — network-level defense independent of patch status. 3. AWS: Enforce IMDSv2 (require session tokens) on all EC2 instances running LangChain agents to neutralize IMDS credential theft even if SSRF succeeds. 4. AUDIT: Grep codebase for RequestsToolkit and OpenAPIToolkit instantiations; verify all are on patched version. 5. DETECT: Alert on HTTP requests to RFC-1918 or link-local (169.254.x.x) addresses originating from agent processes. 6. ISOLATE: Run LangChain agents in isolated network namespaces or VPCs with explicit egress allowlists rather than default-allow.

Q: What systems are affected by CVE-2025-2828?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, OpenAPI integration agents, LLM-powered API automation, RAG pipelines with external data fetching, cloud-hosted AI assistants.

Q: What is the CVSS score for CVE-2025-2828?

CVE-2025-2828 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 21.02%.

GHSA-h5gc-rm8j-5gprCRITICALPoC AVAILABLECISA: ATTEND

Published June 23, 2025

CISO Take

Any LangChain deployment using RequestsToolkit (OpenAPI agents) is exposed to CVSS 10.0 SSRF requiring zero authentication. An attacker can pivot through your agent to steal AWS/Azure instance credentials via metadata endpoints, scan internal networks, and access private services. Upgrade langchain-community to ≥0.0.28 immediately — this is a patch-now situation before your next deployment window.

What is the risk?

CVSS 10.0 with network-accessible vector, zero authentication, no user interaction, and scope change represents maximum theoretical severity. EPSS (0.00052) reflects low current exploitation activity, but the attack is trivial to execute — no AI/ML knowledge required, just a standard SSRF payload. LangChain is widely deployed in production AI systems, and cloud-hosted agents are at highest risk due to IMDSv1 metadata exposure. Any org running LangChain OpenAPI agents should treat this as critical priority.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	pip	—	No patch
149.2KOpenSSF 5.83.2K dependentsPushed 6d ago29% patched~164d to patchFull package profile →
LangChain Community	pip	< 0.0.28	`0.0.28`
149.2KOpenSSF 5.81.3K dependentsPushed 6d ago50% patched~48d to patchFull package profile →

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

21.0%

chance of exploitation in 30 days

Higher than 98% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

○EPSS exploit prediction: 21%

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

6 steps

PATCH
Upgrade langchain-community to ≥0.0.28 immediately — patch is available and targeted.
NETWORK
Block egress from agent hosts to 169.254.169.254 (IMDS), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 via firewall/security groups — network-level defense independent of patch status.
AWS
Enforce IMDSv2 (require session tokens) on all EC2 instances running LangChain agents to neutralize IMDS credential theft even if SSRF succeeds.
AUDIT
Grep codebase for RequestsToolkit and OpenAPIToolkit instantiations; verify all are on patched version.
DETECT
Alert on HTTP requests to RFC-1918 or link-local (169.254.x.x) addresses originating from agent processes.
ISOLATE
Run LangChain agents in isolated network namespaces or VPCs with explicit egress allowlists rather than default-allow.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionAuth BypassFrameworkAgentAML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0075- Cloud Service Discovery AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.1.5-AI risk treatment

NIST AI RMF

MANAGE 2.2-Mechanisms to sustain treatment of identified AI risks

OWASP LLM Top 10

LLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2025-2828?

Is CVE-2025-2828 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-2828, increasing the risk of exploitation.

How to fix CVE-2025-2828?

1. PATCH: Upgrade langchain-community to ≥0.0.28 immediately — patch is available and targeted. 2. NETWORK: Block egress from agent hosts to 169.254.169.254 (IMDS), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 via firewall/security groups — network-level defense independent of patch status. 3. AWS: Enforce IMDSv2 (require session tokens) on all EC2 instances running LangChain agents to neutralize IMDS credential theft even if SSRF succeeds. 4. AUDIT: Grep codebase for RequestsToolkit and OpenAPIToolkit instantiations; verify all are on patched version. 5. DETECT: Alert on HTTP requests to RFC-1918 or link-local (169.254.x.x) addresses originating from agent processes. 6. ISOLATE: Run LangChain agents in isolated network namespaces or VPCs with explicit egress allowlists rather than default-allow.

What systems are affected by CVE-2025-2828?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, OpenAPI integration agents, LLM-powered API automation, RAG pipelines with external data fetching, cloud-hosted AI assistants.

What is the CVSS score for CVE-2025-2828?

CVE-2025-2828 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 21.02%.

What is the AI security impact?

Affected AI Architectures

agent frameworksOpenAPI integration agentsLLM-powered API automationRAG pipelines with external data fetchingcloud-hosted AI assistants

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0075Cloud Service Discovery

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result, an attacker could exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. This issue has been fixed in version 0.0.28.

Exploitation Scenario

Attacker interacts with a customer-facing LangChain OpenAPI agent — such as an AI assistant with web browsing or API integration capabilities. Attacker crafts a query that causes the agent to invoke RequestsToolkit with URL http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). Since RequestsToolkit applies no URL or address filtering, it fetches the endpoint and returns temporary IAM credentials bound to the agent host's instance role. Attacker now holds valid AWS credentials potentially granting access to S3, RDS, Secrets Manager, and other services in scope of that IAM role — full cloud lateral movement from a single LLM query. No AI/ML expertise required; this is a known SSRF pattern applied to an AI agent surface.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.