CVE-2026-125386: LangChain IDOR exposes other

CISO Take

langchain4j-aideepin through 3.32.0 has an insecure direct object reference in its CharacterMessageController: any authenticated user can supply another user's message UUID to the knowledge-embedding-ref, memory-embedding-ref or graph-ref endpoints and read that user's knowledge-base chunks, long-term memory text and knowledge-graph data. The CVSS of 5.3 (medium) understates the business impact for multi-tenant deployments, because the confidentiality loss is high and the leaked content can include proprietary documents and personal conversation memory. Exploitation requires a valid account and knowledge of a target UUID (hence the high attack complexity), and there is no EPSS score, KEV listing, public exploit or Nuclei template, so near-term mass exploitation looks unlikely. The package has 3,161 downstream dependents, an OpenSSF Scorecard of 5.8/10 and 61 other CVEs, which points to a weak security track record and a patch cadence that deserves scrutiny. Apply the upstream fix (commit 483499b) or upgrade past 3.32.0, and until then restrict registration, review access logs for these three endpoints, and treat any shared knowledge base or memory as potentially exposed.

Sources:NVDOpenSSFATLASVulncCheck advisoryGitHub

What is the risk?

Medium overall. Exploitability is limited by the need for authentication (PR:L) and a valid target message UUID (AC:H), and there is no evidence of public exploits, scanner templates, KEV listing or an EPSS score. Impact is confidentiality-only but high: RAG chunks, long-term memory and graph data may contain sensitive corporate or personal content. Risk rises sharply for deployments with open self-registration or many tenants, since any registered user becomes a potential attacker. The project's low Scorecard (5.8/10) and 61 prior CVEs raise the likelihood of related authorization flaws.

How does the attack unfold?

Initial Access

Attacker registers or uses a low-privilege authenticated account on the target deployment.

AML.T0012

Target Discovery

Attacker obtains or guesses another user's message UUID from shared links, logs or other API responses.

AML.T0006

Exploitation

Attacker calls the knowledge-embedding-ref, memory-embedding-ref or graph-ref endpoints with the victim's UUID, bypassing the missing owner check.

AML.T0085.000

Impact

Attacker exfiltrates the victim's knowledge-base chunks, long-term memory text and knowledge-graph data.

AML.T0036

Initial Access

Attacker registers or uses a low-privilege authenticated account on the target deployment.

AML.T0012

Target Discovery

Attacker obtains or guesses another user's message UUID from shared links, logs or other API responses.

AML.T0006

Exploitation

Attacker calls the knowledge-embedding-ref, memory-embedding-ref or graph-ref endpoints with the victim's UUID, bypassing the missing owner check.

AML.T0085.000

Impact

Attacker exfiltrates the victim's knowledge-base chunks, long-term memory text and knowledge-graph data.

AML.T0036

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	pip	—	No patch
149.2KOpenSSF 5.83.2K dependentsPushed 6d ago29% patched~164d to patchFull package profile →

Do you use LangChain? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade to a release containing the fix from commit 483499b1a6b4a27d856f85d88c28ae6152660953 (versions after 3.32.0), or cherry-pick the patch. 2) Until patched, put a reverse proxy or WAF rule in front of the knowledge-embedding-ref, memory-embedding-ref and graph-ref endpoints that enforces that the message UUID belongs to the caller, or block those routes. 3) Disable open self-registration or limit accounts to trusted users. 4) Detect abuse by reviewing access logs for authenticated users requesting message UUIDs that are not theirs, bursts of requests across many UUIDs, or 4xx/2xx patterns on those endpoints. 5) Treat knowledge bases and memory in shared deployments as potentially disclosed and assess whether notification obligations apply. 6) Audit other controllers for missing ownership checks, given the package's history of 61 CVEs.

How is it classified?

Data LeakageAuth BypassData ExtractionRAGAPIFrameworkAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0085.000- RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality and security of data for AI systems

NIST AI RMF

MANAGE 2.3-Risk treatment and response to identified risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-125386?

langchain4j-aideepin through 3.32.0 has an insecure direct object reference in its CharacterMessageController: any authenticated user can supply another user's message UUID to the knowledge-embedding-ref, memory-embedding-ref or graph-ref endpoints and read that user's knowledge-base chunks, long-term memory text and knowledge-graph data. The CVSS of 5.3 (medium) understates the business impact for multi-tenant deployments, because the confidentiality loss is high and the leaked content can include proprietary documents and personal conversation memory. Exploitation requires a valid account and knowledge of a target UUID (hence the high attack complexity), and there is no EPSS score, KEV listing, public exploit or Nuclei template, so near-term mass exploitation looks unlikely. The package has 3,161 downstream dependents, an OpenSSF Scorecard of 5.8/10 and 61 other CVEs, which points to a weak security track record and a patch cadence that deserves scrutiny. Apply the upstream fix (commit 483499b) or upgrade past 3.32.0, and until then restrict registration, review access logs for these three endpoints, and treat any shared knowledge base or memory as potentially exposed.

Is CVE-2026-125386 actively exploited?

No confirmed active exploitation of CVE-2026-125386 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-125386?

1) Upgrade to a release containing the fix from commit 483499b1a6b4a27d856f85d88c28ae6152660953 (versions after 3.32.0), or cherry-pick the patch. 2) Until patched, put a reverse proxy or WAF rule in front of the knowledge-embedding-ref, memory-embedding-ref and graph-ref endpoints that enforces that the message UUID belongs to the caller, or block those routes. 3) Disable open self-registration or limit accounts to trusted users. 4) Detect abuse by reviewing access logs for authenticated users requesting message UUIDs that are not theirs, bursts of requests across many UUIDs, or 4xx/2xx patterns on those endpoints. 5) Treat knowledge bases and memory in shared deployments as potentially disclosed and assess whether notification obligations apply. 6) Audit other controllers for missing ownership checks, given the package's history of 61 CVEs.

What systems are affected by CVE-2026-125386?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, Multi-tenant LLM chat applications, Knowledge graph (GraphRAG) systems, LLM long-term memory stores, LLM application frameworks (Java).

What is the CVSS score for CVE-2026-125386?

CVE-2026-125386 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesMulti-tenant LLM chat applicationsKnowledge graph (GraphRAG) systemsLLM long-term memory storesLLM application frameworks (Java)

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0085.000RAG Databases

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM08

What are the technical details?

Original Advisory

langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data.

Exploitation Scenario

An attacker registers an account on a multi-tenant deployment of an AI chat platform built on langchain4j-aideepin. They obtain or guess message UUIDs for another user, for example from shared links, logs, referrer leaks or other API responses. They then call the memory-embedding-ref, knowledge-embedding-ref and graph-ref endpoints with those UUIDs. Because the server does not check ownership, it returns the victim's retrieved knowledge-base chunks, long-term memory text and knowledge-graph data, which the attacker harvests at scale to steal proprietary documents or personal information.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.