CVE-2026-26013: 
Python vulnerability analysis and mitigation

CVE-2026-26013 is a Server-Side Request Forgery (SSRF) vulnerability in LangChain's ChatOpenAI.get_num_tokens_from_messages() method, classified as CWE-918. The flaw affects langchain-core versions prior to 1.2.11 (Python pip package) and was disclosed on February 10, 2026. It also impacts several IBM products that bundle LangChain, including IBM Cloud Pak for Business Automation, IBM Business Automation Workflow, IBM watsonx Orchestrate Developer Edition, IBM App Connect Enterprise, and IBM Engineering AI Hub. The CVSS v3.1 base score is 3.7 (Low) (GitHub Advisory, Feedly).

The root cause (CWE-918) lies in the _url_to_size() helper function called by get_num_tokens_from_messages() when processing messages containing image_url content blocks for vision-enabled models. Specifically, for images without detail: "low", the method calls httpx.get(image_source) on any attacker-supplied URL without any validation, IP range filtering, or scheme checks. This means an attacker who can inject a malicious image_url into a message — even outside of direct model invocation (e.g., in logging, metrics, or token budgeting flows) — can cause the server to issue arbitrary outbound HTTP requests. The vulnerable file is libs/partners/openai/langchain_openai/chat_models/base.py (GitHub Advisory, Patch Commit).

This is a blind SSRF vulnerability — responses from the forged requests are not returned to the attacker, limiting direct data exfiltration. However, an attacker can cause the application server to probe internal network resources, including RFC 1918 private IP ranges and cloud provider metadata endpoints (e.g., 169.254.169.254 for AWS/GCP/Azure), potentially enabling infrastructure enumeration or credential harvesting in cloud environments. Minor resource consumption (bounded by a 5-second timeout) is also possible, though non-image responses fail at PIL image parsing, further limiting impact (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.019% (6th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity (the attacker must be able to control image_url values passed to the token counting method), but no privileges or user interaction are needed.

1. Identify a target application: Find a LangChain-based application using ChatOpenAI with vision-enabled models and langchain-core < 1.2.11, where user-controlled input can influence message content (e.g., a chatbot accepting image URLs).
2. Craft a malicious message: Construct a message payload containing an image_url content block pointing to an internal target, such as a cloud metadata endpoint or internal service:

   {"role": "user", "content": [{"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/"}}]}

3. Trigger token counting: Submit the crafted message to any application flow that calls get_num_tokens_from_messages() — this may occur during logging, token budgeting, or pre-invocation checks, not necessarily during model inference.
4. Observe blind SSRF: The server issues an httpx.get() request to the attacker-specified URL. Since this is blind SSRF, direct response data is not returned, but the request can be confirmed via out-of-band techniques (e.g., a controlled external server logging the incoming request) or by observing timing differences.
5. Enumerate internal resources: Iterate over internal IP ranges or known cloud metadata paths to map accessible internal services, potentially gathering instance metadata, credentials, or network topology information (GitHub Advisory, Patch Commit).

• Network: Unexpected outbound HTTP GET requests from the application server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) or cloud metadata endpoints (169.254.169.254, 169.254.170.2, 100.100.100.200).
• Network: Outbound connections to external attacker-controlled hosts originating from the LangChain application process, particularly to uncommon ports or domains not in normal egress patterns.
• Logs: Application or web server logs showing httpx requests to internal/metadata URLs triggered during token counting operations (look for log entries referencing get_num_tokens_from_messages or _url_to_size).
• Logs: PIL/Pillow image parsing errors in application logs when non-image content is returned from SSRF targets (e.g., UnidentifiedImageError or similar exceptions).
• Process: Unusual network activity from the Python process running LangChain, particularly short-lived TCP connections (≤5 seconds) to internal addresses.

The primary remediation is to upgrade langchain-core to version 1.2.11 or later and langchain-openai to version 1.1.9 or later. The patch introduces SSRF validation via langchain_core._security._ssrf_protection.validate_safe_url(), which blocks private IP ranges, cloud metadata endpoints, and invalid URL schemes, and adds a 50 MB size limit and explicit 5-second timeout. It also adds an allow_fetching_images=False parameter to disable image fetching entirely. For those unable to upgrade immediately, validate and sanitize all image_url values before passing messages to token counting or model invocation, and implement network-level egress filtering to block outbound requests to private IP ranges and metadata endpoints (GitHub Advisory, LangChain Release). IBM product users should apply the relevant iFixes detailed in IBM's security bulletins (IBM CP4BA Bulletin, IBM ACE Bulletin).