CVE-2026-25750: LangSmith Auth Bypass Vulnerability

CVE-2026-25750 Overview

CVE-2026-25750 is a URL parameter injection vulnerability in LangSmith Studio, a component of Langchain Helm Charts used for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, the vulnerability allowed unauthorized access to user accounts through stolen authentication tokens. Both LangSmith Cloud and self-hosted deployments were affected by this security flaw.

Authenticated LangSmith users who clicked on a specially crafted malicious link would unknowingly have their bearer token, user ID, and workspace ID transmitted to an attacker-controlled server. With these stolen credentials, an attacker could impersonate the victim and access any LangSmith resources or perform any actions the user was authorized to perform within their workspace.

Critical Impact

Attackers can steal authentication tokens via social engineering, enabling full account impersonation and unauthorized access to LangSmith workspace resources.

Affected Products

• LangSmith Studio (Cloud deployments) prior to version 0.12.71
• LangSmith Studio (Self-hosted deployments) prior to version 0.12.71
• Langchain Helm Charts (langchain-ai/helm) prior to version 0.12.71

Discovery Timeline

• 2026-03-04 - CVE CVE-2026-25750 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-25750

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as Injection. The flaw exists in how LangSmith Studio handles the baseUrl parameter without proper validation or origin restrictions.

The attack requires a network-accessible vector and relies on user interaction, specifically requiring a victim to click a malicious link. The vulnerability impacts confidentiality and integrity significantly, as stolen tokens grant complete access to the victim's LangSmith workspace and all associated resources. The stolen bearer tokens have a 5-minute expiration window, though persistent attackers could repeatedly target users through continued social engineering campaigns.

Root Cause

The root cause of CVE-2026-25750 lies in the absence of validation for user-defined allowed origins in the baseUrl parameter. LangSmith Studio failed to implement proper restrictions on where authentication tokens could be transmitted, allowing attackers to craft URLs that would redirect sensitive credentials to unauthorized external servers.

The lack of origin validation meant that any arbitrary URL could be specified as the destination for authentication data, bypassing the intended security boundaries of the application.

Attack Vector

The attack exploits the URL parameter injection vulnerability through social engineering techniques. An attacker crafts a malicious URL containing an attacker-controlled server address in the baseUrl parameter. This link is then distributed to potential victims through phishing emails, malicious chat messages, or other social engineering vectors.

When an authenticated LangSmith user clicks the crafted link, the application processes the malicious baseUrl parameter and transmits the user's bearer token, user ID, and workspace ID to the attacker's server. The attacker captures these credentials and can immediately use them to impersonate the victim, gaining full access to their LangSmith workspace resources.

The attack requires convincing users to click the malicious link, making it a targeted social engineering attack. While the 5-minute token expiration provides some mitigation, repeated attacks against the same user remain possible if they continue to click malicious links.

Detection Methods for CVE-2026-25750

Indicators of Compromise

• Unusual outbound connections from LangSmith Studio to external, unauthorized domains
• Authentication tokens being transmitted to non-standard or suspicious external URLs
• User session activity from unexpected IP addresses or geographic locations following link clicks
• Multiple rapid authentication attempts or workspace access from different locations for the same user

Detection Strategies

• Monitor web application logs for requests containing modified baseUrl parameters pointing to external domains
• Implement network traffic analysis to detect bearer tokens being sent to non-whitelisted destinations
• Deploy URL inspection rules to identify and block malicious parameter injection patterns
• Review user access patterns for signs of account impersonation or unusual workspace activity

Monitoring Recommendations

• Enable comprehensive logging for all authentication token transmissions and validate destination URLs
• Configure alerts for outbound connections to unknown or suspicious domains from LangSmith services
• Implement user behavior analytics to detect anomalous access patterns indicative of credential theft
• Establish baseline network communication patterns for LangSmith deployments to identify deviations

How to Mitigate CVE-2026-25750

Immediate Actions Required

• Upgrade langchain-ai/helm to version 0.12.71 or later immediately
• Review workspace access logs for any suspicious activity or unauthorized access
• Educate users about phishing risks and the importance of verifying links before clicking
• Implement additional URL filtering at the network perimeter to block known malicious domains

Patch Information

The vulnerability has been addressed in langchain-ai/helm version 0.12.71. The fix implements validation requiring user-defined allowed origins for the baseUrl parameter, effectively preventing authentication tokens from being sent to unauthorized servers.

Self-hosted customers must manually upgrade to the patched version to remediate this vulnerability. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• No known workarounds are available for this vulnerability
• Self-hosted customers must upgrade to version 0.12.71 as the only remediation option
• Consider implementing network-level controls to restrict outbound token transmission as a defense-in-depth measure
• Enforce strict user security awareness training regarding phishing and malicious link identification

# Upgrade Langchain Helm Charts to patched version
helm repo update langchain-ai
helm upgrade langsmith langchain-ai/langsmith --version 0.12.71

# Verify the installed version
helm list -n langsmith-namespace | grep langsmith