CVE-2026-26019: langchain_community: SSRF allows internal network access

MEDIUM

Published February 11, 2026

CISO Take

CVE-2026-26019 is an SSRF vulnerability in LangChain's RecursiveUrlLoader — if you're using it in any RAG ingestion pipeline or web research agent, an attacker controlling any page in the crawl path can redirect your crawler to cloud metadata endpoints (AWS IMDSv1, GCP metadata) or internal RFC 1918 infrastructure. Upgrade @langchain/community to 1.1.14 immediately. If you cannot patch today, disable RecursiveUrlLoader or enforce network-level SSRF controls (IMDSv2 enforcement, block 169.254.169.254 at the firewall).

What is the risk?

Nominal CVSS is 4.1 (Medium), but contextual risk is significantly elevated in cloud-hosted AI workloads. The SSRF can reach AWS IMDSv1 without requiring token headers, enabling IAM credential theft that breaks the CVSS scope. In environments running LangChain agents on EC2, ECS, or Lambda, successful exploitation could escalate to account-level compromise. The attack requires the crawler to visit an attacker-influenced page (UI:R), making this realistic only in real-world crawl operations — not a theoretical edge case for LLM-powered research agents.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	pip	—	No patch
148.8KOpenSSF 5.73.2K dependentsPushed 5d ago30% patched~164d to patchFull package profile →

Do you use LangChain? You're affected.

How severe is it?

CVSS 3.1

4.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CLow

INone

ANone

What should I do?

5 steps

PATCH
Upgrade @langchain/community to >= 1.1.14 immediately. Verify package-lock.json or yarn.lock reflects the update.
NETWORK CONTROLS
Enforce IMDSv2 (token-required) on all EC2/ECS instances running LangChain workloads. Block access to 169.254.169.254 via iptables/security groups. Block RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from application-layer outbound requests.
WORKAROUND (if unable to patch): Replace RecursiveUrlLoader with a custom crawler that validates URLs against a semantic parser and an explicit allowlist, not string prefix matching.
DETECTION
Monitor for outbound requests to 169.254.169.254, ::1, or private IP ranges from LangChain application pods/containers. Alert on HTTP requests from application processes to cloud metadata endpoints.
AUDIT
Review all usages of RecursiveUrlLoader in your codebase, especially those accepting URLs from user input or external data sources.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionFrameworkRAGAgentAML.T0006- Active Scanning AML.T0010.001- AI Software AML.T0049- Exploit Public-Facing Application AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0064- Gather RAG-Indexed Targets AML.T0075- Cloud Service Discovery AML.T0085- Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurityArticle 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.1.5-Information Security for AI SystemsA.6.2.6-Risk treatment for AI systemsA.9.4-AI system security

NIST AI RMF

GOVERN-6.2-Organizational policies and practices for AI risk managementMANAGE-2.2-Mechanisms to sustain AI risk managementMANAGE-2.4-Risk Treatment and Vulnerability Mitigation

OWASP LLM Top 10

LLM01-Prompt InjectionLLM03:2025-Supply Chain VulnerabilitiesLLM05-Supply Chain VulnerabilitiesLLM06:2025-Excessive AgencyLLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-26019?

Is CVE-2026-26019 actively exploited?

No confirmed active exploitation of CVE-2026-26019 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-26019?

1. PATCH: Upgrade @langchain/community to >= 1.1.14 immediately. Verify package-lock.json or yarn.lock reflects the update. 2. NETWORK CONTROLS: Enforce IMDSv2 (token-required) on all EC2/ECS instances running LangChain workloads. Block access to 169.254.169.254 via iptables/security groups. Block RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from application-layer outbound requests. 3. WORKAROUND (if unable to patch): Replace RecursiveUrlLoader with a custom crawler that validates URLs against a semantic parser and an explicit allowlist, not string prefix matching. 4. DETECTION: Monitor for outbound requests to 169.254.169.254, ::1, or private IP ranges from LangChain application pods/containers. Alert on HTTP requests from application processes to cloud metadata endpoints. 5. AUDIT: Review all usages of RecursiveUrlLoader in your codebase, especially those accepting URLs from user input or external data sources.

What systems are affected by CVE-2026-26019?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, web scraping and document ingestion pipelines, LLM-powered research agents, autonomous AI agents with web access.

What is the CVSS score for CVE-2026-26019?

CVE-2026-26019 has a CVSS v3.1 base score of 4.1 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesagent frameworksweb scraping and document ingestion pipelinesLLM-powered research agentsautonomous AI agents with web access

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0010.001AI Software

AML.T0049Exploit Public-Facing Application

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0064Gather RAG-Indexed Targets

AML.T0075Cloud Service Discovery

AML.T0085Data from AI Services

Compliance Controls Affected

EU AI Act: Art. 15, Article 15

ISO 42001: A.6.1.5, A.6.2.6, A.9.4

NIST AI RMF: GOVERN-6.2, MANAGE-2.2, MANAGE-2.4

OWASP LLM Top 10: LLM01, LLM03:2025, LLM05, LLM06:2025, LLM07

What are the technical details?

Original Advisory

LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.

Exploitation Scenario

An adversary targeting a company that uses a LangChain-powered research agent for competitive intelligence identifies that the agent crawls industry news sites. The adversary compromises or creates a page on a domain sharing a prefix with the crawl target (e.g., target-news.com vs target-news.com.attacker.com) or embeds a link to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on a page the crawler will visit. When the research agent's RecursiveUrlLoader processes the malicious page, it follows the link without validation, fetches the AWS metadata endpoint, and the response (containing temporary IAM credentials) is processed as content — potentially stored in the RAG database or logged. The attacker can then query the agent or access logs to extract the credentials and pivot to the cloud account.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.