CVE-2026-26019 (CVSS 5.3) LangChain SSRF Vulnerability Exposes Internal Services

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Langchain Community SSRF Vulnerability Exposes Internal Services A Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-26019, has been discovered in the langchain/community package, affecting versions up to 1.1.13. This flaw has a moderate severity rating and can potentially expose sensitive cloud metadata and internal infrastructure due to its origin in the RecursiveUrlLoader class, which performs recursive web crawling. 4 sources 32