CVE-2026-25750

Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts through stolen authentication tokens. The vulnerability affected both LangSmith Cloud and self-hosted deployments. Authenticated LangSmith users who clicked on a specially crafted malicious link would have their bearer token, user ID, and workspace ID transmitted to an attacker-controlled server. With this stolen token, an attacker could impersonate the victim and access any LangSmith resources or perform any actions the user was authorized to perform within their workspace. The attack required social engineering (phishing, malicious links in emails or chat applications) to convince users to click the crafted URL. The stolen tokens expired after 5 minutes, though repeated attacks against the same user were possible if they could be convinced to click malicious links multiple times. The fix in version 0.12.71 implements validation requiring user-defined allowed origins for the baseUrl parameter, preventing tokens from being sent to unauthorized servers. No known workarounds are available. Self-hosted customers must upgrade to the patched version.

A threat actor targeting an organization's AI pipeline begins by identifying LangSmith usage via job postings referencing LangChain or public GitHub repositories. The attacker registers a lookalike domain (e.g., langsmith-security-notice.com) and sets up a token capture endpoint. They craft a LangSmith URL with the vulnerable baseUrl parameter pointing to their server and embed it in a spearphishing email: 'Action required: your LangSmith workspace has been flagged for unusual activity — verify your account.' A developer or ML engineer clicks the link; their browser silently transmits the bearer token, user ID, and workspace ID to the attacker's server. Within 5 minutes, the attacker authenticates to LangSmith, exports all traces (extracting embedded OpenAI/Anthropic API keys from logged headers), downloads evaluation datasets, and maps the organization's complete AI system architecture from run metadata. If the attack is detected and the token expires, the attacker can repeat the phishing attempt — the vulnerability requires no elevated access to exploit repeatedly.