CVE-2026-41488: Langchain-openai SSRF Vulnerability

CVE-2026-41488 Overview

A Server-Side Request Forgery (SSRF) vulnerability exists in LangChain's langchain-openai package prior to version 1.1.14. The vulnerability resides in the _url_to_size() helper function, which is used by get_num_tokens_from_messages for image token counting. The function validates URLs for SSRF protection and then fetches them in a separate network operation with independent DNS resolution. This creates a Time-of-Check Time-of-Use (TOCTOU) / DNS rebinding window where an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch, potentially allowing access to internal network resources.

Critical Impact

Attackers can exploit this DNS rebinding vulnerability to bypass SSRF protections and access internal services, potentially exposing sensitive data from localhost or private network resources.

Affected Products

• langchain-openai versions prior to 1.1.14

Discovery Timeline

• April 24, 2026 - CVE CVE-2026-41488 published to NVD
• April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41488

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The core issue stems from a TOCTOU race condition in the URL validation and fetching logic within the langchain-openai package.

The _url_to_size() helper function performs SSRF validation by checking if a URL resolves to a safe, public IP address. However, due to the architecture of the function, DNS resolution occurs twice: once during validation and once during the actual HTTP request. This separation creates a window of opportunity for DNS rebinding attacks.

The vulnerability requires network access and user interaction, with the attack complexity being high due to the timing-sensitive nature of DNS rebinding. Successful exploitation can lead to limited confidentiality impact, allowing attackers to potentially read data from internal services that would otherwise be inaccessible.

Root Cause

The root cause is the separation between URL validation and URL fetching operations. When _url_to_size() validates a URL, it performs DNS resolution to verify the target IP is not private or localhost. However, when the actual HTTP fetch occurs, a new DNS resolution is performed independently. An attacker controlling a malicious DNS server can respond with a public IP during the validation phase and switch to a private/internal IP (such as 127.0.0.1 or 10.x.x.x) during the fetch phase.

This TOCTOU vulnerability pattern is common in SSRF protection implementations that don't pin DNS resolution results between validation and usage.

Attack Vector

The attack requires an attacker to control both a malicious URL (embedded in user-controlled content processed by LangChain) and a DNS server capable of performing rebinding. The attack flow involves:

1. The attacker provides a malicious URL pointing to their controlled domain
2. LangChain's get_num_tokens_from_messages function calls _url_to_size() to process the image URL
3. During validation, the attacker's DNS server responds with a public IP address, passing the SSRF check
4. During the actual fetch (which performs a new DNS lookup), the attacker's DNS server responds with a private/localhost IP
5. The request is made to the internal service, potentially leaking sensitive information

The vulnerability exploits the time gap between DNS validation and HTTP request execution. For detailed technical analysis and remediation guidance, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-41488

Indicators of Compromise

• Outbound HTTP requests from LangChain applications targeting internal IP addresses (127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16.x.x)
• DNS queries showing rapid TTL expiration or multiple resolutions for the same domain with different IP results
• Unusual access patterns to internal services from application servers running LangChain workloads

Detection Strategies

• Monitor DNS resolution patterns for domains accessed by LangChain applications, looking for short TTL values or IP address changes
• Implement network segmentation alerts for internal service access from application tier servers
• Enable logging for all outbound HTTP requests from LangChain applications and audit for internal IP targets

Monitoring Recommendations

• Deploy network intrusion detection systems (IDS) to monitor for DNS rebinding patterns
• Configure application-level logging to capture all URLs processed by get_num_tokens_from_messages
• Establish baseline network behavior for LangChain applications to detect anomalous internal network access

How to Mitigate CVE-2026-41488

Immediate Actions Required

• Upgrade langchain-openai to version 1.1.14 or later immediately
• Review application logs for any suspicious internal network access patterns
• Implement network-level controls to restrict application servers from accessing internal services directly

Patch Information

The vulnerability has been addressed in langchain-openai version 1.1.14. The fix likely implements DNS pinning or performs a single DNS resolution that is reused for both validation and fetching, eliminating the TOCTOU window. For complete patch details and upgrade instructions, see the GitHub Security Advisory.

Workarounds

• Implement network-level egress filtering to prevent application servers from accessing private IP ranges
• Deploy a DNS resolver that caches results and prevents rapid IP changes for the same domain
• Use a proxy server for all outbound HTTP requests that performs its own SSRF validation with DNS pinning

# Example: Network-level mitigation using iptables to block access to private ranges
# Block access to localhost
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP

# Block access to private networks
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Block link-local addresses
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP