LangChain Community Flaw Allows SSRF Bypass to Access Internal Infrastructure

Back Cyberpress

LangChain Community Flaw Allows SSRF Bypass to Access Internal Infrastructure

Cyberpress • February 17, 2026

Share: View original

CVSS Score, Description. CVE-2026-26019, 6.1 (Medium), SSRF bypass in @langchain/community RecursiveUrlLoader due to insufficient URL origin ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Langchain Community SSRF Vulnerability Exposes Internal Services A Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-26019, has been discovered in the langchain/community package, affecting versions up to 1.1.13. This flaw has a moderate severity rating and can potentially expose sensitive cloud metadata and internal infrastructure due to its origin in the RecursiveUrlLoader class, which performs recursive web crawling. 4 sources 32

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application