URL Parameter Injection Vulnerability in Langsmith Studio by Langchain

CVE-2026-25750

What is CVE-2026-25750?

A URL parameter injection vulnerability exists in Langsmith Studio, impacting Langchain applications deployed on Kubernetes prior to version 0.12.71. This flaw could allow malicious actors to gain unauthorized access to user accounts by stealing authentication tokens. When authenticated users click on specially crafted links, their bearer tokens, user IDs, and workspace IDs may be transmitted to an attacker-controlled server. Although the stolen tokens expire after 5 minutes, attackers can repeatedly exploit the vulnerability if users are tricked into clicking malicious links multiple times. The appropriate fix in version 0.12.71 introduces validation for user-defined allowed origins for the baseUrl parameter, effectively preventing unauthorized transmission of tokens. Users operating self-hosted deployments are urged to upgrade to the latest version to secure their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References