Server-Side Request Forgery Vulnerability in LangChain Framework

CVE-2026-27795

What is CVE-2026-27795?

Earlier versions of the LangChain framework, specifically those prior to 1.1.8, are susceptible to a redirect-based Server-Side Request Forgery (SSRF) bypass. The vulnerability exists within the RecursiveUrlLoader, which incorrectly validates the initial URL and permits the underlying fetch operation to follow redirects automatically. This behavior can enable a transition from a whitelisted public URL to an internal service or metadata endpoint without proper revalidation. As a recommended security measure, users are urged to upgrade to version 1.1.18, where all redirect hops are validated and automatic redirects are disabled, ensuring that the locations are confirmed safe before proceeding.

References