ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27795

LangChain is a framework for building LLM-powered applications.

Published Feb 25, 2026 · updated Jun 17, 2026 · langchain langchain community

LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in in . The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019). Users should upgrade to 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating targets before following them. In this version, automatic redirects are disabled ( ), each 3xx is resolved and validated with before the next request, and a maximum redirect limit prevents infinite loops.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in in . The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SS

  2. Jun 17, 2026 · NIST NVD

    Updated

    LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in in . The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SS

Affected

  • cpe langchain/langchain communityversion unspecified

Sources

  • NIST NVDVulnerability recordCVE-2026-27795

    LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in in . The loader validates the initial URL but allows the underlying fetch to fol

    nvd.nist.gov

References