CVE-2026-26013: LangChain SSRF Vulnerability in ChatOpenAI Image Token Counting
Summary
CVE-2026-26013: LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages. Affects langchain-core versions < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LangChain is an open-source framework designed for building applications powered by language models. It provides various tools and integrations to facilitate the development of AI-driven applications. The framework includes components for handling messages, including those with image URLs, which are processed to compute token counts for vision-enabled models. However, a vulnerability has been identified in the way LangChain handles image URLs, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the ChatOpenAI.get_num_tokens_from_messages() method, which fetches arbitrary image_url values without proper validation. This oversight allows attackers to exploit the system through Server-Side Request Forgery (SSRF) attacks by submitting malicious image URLs. The implications include unauthorized HTTP requests from the application server to both internal and external resources, potentially exposing sensitive internal network information. The vulnerability is classified as low severity due to its limited impact, including blind SSRF, a default timeout of 5 seconds, and failure of non-image responses during parsing.
How To Fix
Latest published version: 1.7.0 as of 22 Oct 2026
pip install --upgrade "langchain-core==1.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.11
This is the first release that contains the fix.
pip install --upgrade "langchain-core==1.2.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider the following workaround: Validate and filter image_url values before passing them to the get_num_tokens_from_messages() method. Implementing input sanitization can help mitigate the risk of SSRF attacks. Example code for sanitization could look like this:
def sanitize_image_url(image_url):
# Add validation logic to ensure the URL is safe
if is_safe_url(image_url):
return image_url
else:
raise ValueError('Unsafe URL')
# Usage
try:
safe_url = sanitize_image_url(user_provided_url)
# Proceed with safe_url
except ValueError as e:
print(e)
Conclusion
In summary, the SSRF vulnerability in LangChain's ChatOpenAI.get_num_tokens_from_messages() method poses a risk due to improper handling of image URLs. It is crucial to update to the patched version or implement input sanitization to mitigate potential attacks.
See every vulnerability recorded for langchain-core →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially exposing sensitive data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The potential impacts include unauthorized access to internal network resources, minor resource consumption from image downloads, and exposure to external URLs.
Yes, the vulnerability has been patched in langchain-openai==1.1.9 and requires langchain-core==1.2.11.
If you cannot upgrade immediately, sanitize input by validating and filtering image_url values before processing them.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-core.
