CVE-2026-59152 Overview
CVE-2026-59152 is a path traversal vulnerability [CWE-22] in the LangSmith Client SDK's TracingMiddleware component. An attacker who can send an HTTP request to a server running the middleware can force that server to read an arbitrary file from its local filesystem. The middleware then uploads the file contents to LangSmith as a trace attachment. Depending on the deployment of the distributed trace system, triggering the file read may not require authentication. Retrieving the exfiltrated contents requires read access to the LangSmith workspace receiving the traces. The vulnerability is fixed in LangSmith SDK version 0.8.18.
Critical Impact
A low-privilege LangSmith workspace member, contractor, or compromised teammate account can read arbitrary files from any server running TracingMiddleware, crossing the intended workspace trust boundary.
Affected Products
- LangSmith Client SDK versions prior to 0.8.18
- Applications embedding the LangSmith SDK TracingMiddleware
- Distributed trace deployments forwarding traces to LangSmith workspaces
Discovery Timeline
- 2026-07-06 - CVE-2026-59152 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-59152
Vulnerability Analysis
The LangSmith Client SDK provides libraries for interacting with the LangSmith observability platform. The SDK includes a TracingMiddleware component that intercepts HTTP requests and emits trace data, including request-associated attachments, to a configured LangSmith workspace. The vulnerability allows an attacker-controlled HTTP request to influence which local file the middleware reads and attaches to the outgoing trace. The middleware then transmits the file contents to LangSmith, where any principal with trace-read access to the destination workspace can retrieve them. The result is a trust-boundary crossing between an application server and a workspace membership that was never intended to have host filesystem access.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The TracingMiddleware accepts a file path derived from request data without validating that the resolved path stays within an allowed directory. Path components such as ../ traverse outside the intended scope, letting the middleware open files like /etc/passwd, application configuration, cloud credentials, or private keys on the host running the middleware.
Attack Vector
The attack is network-based and requires low complexity. An attacker sends a crafted HTTP request to any endpoint served by an application using the vulnerable TracingMiddleware. The middleware resolves the attacker-influenced path, reads the target file, and uploads it as a trace attachment to the configured LangSmith workspace. A separate actor with workspace trace-read privileges (or the same actor, if they possess both capabilities) then downloads the attachment from LangSmith. In deployments where trace ingestion does not require authentication, the initial file-read trigger can be executed by an unauthenticated remote user.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-f4xh-w4cj-qxq8 for technical details.
Detection Methods for CVE-2026-59152
Indicators of Compromise
- Outbound HTTPS traffic from application servers to LangSmith trace ingestion endpoints containing unexpectedly large attachment payloads.
- Trace records in LangSmith workspaces containing attachments whose names or contents match sensitive host paths such as /etc/passwd, id_rsa, or cloud metadata files.
- HTTP request logs showing path traversal sequences (../, %2e%2e%2f) targeting endpoints handled by TracingMiddleware.
Detection Strategies
- Audit LangSmith workspace traces for attachments containing filesystem paths or file contents that were not expected to be captured by application telemetry.
- Inspect application access logs for request parameters or headers containing traversal patterns forwarded to services running the LangSmith SDK.
- Inventory running services to identify installations of langsmith SDK versions earlier than 0.8.18.
Monitoring Recommendations
- Alert on egress connections from application hosts to LangSmith endpoints that transmit attachment payloads exceeding normal trace sizes.
- Monitor LangSmith workspace membership changes and review the audit history for trace downloads by low-privilege members or contractor accounts.
- Track SDK dependency versions in continuous integration and generate alerts when a build produces artifacts pinned to a vulnerable LangSmith SDK release.
How to Mitigate CVE-2026-59152
Immediate Actions Required
- Upgrade the LangSmith Client SDK to version 0.8.18 or later in all services that instantiate TracingMiddleware.
- Review LangSmith workspace membership and revoke trace-read access for accounts that do not require it.
- Rotate any credentials, tokens, or keys stored on hosts that ran vulnerable middleware and are reachable from network-exposed endpoints.
Patch Information
The vulnerability is fixed in LangSmith Client SDK 0.8.18. Vendor details are published in the LangSmith SDK Security Advisory GHSA-f4xh-w4cj-qxq8. Update the SDK dependency in the project manifest (for example requirements.txt, pyproject.toml, or package.json) and redeploy affected services.
Workarounds
- Disable TracingMiddleware on internet-facing services until the SDK is upgraded.
- Require authentication on all endpoints that invoke tracing, preventing unauthenticated requests from triggering the file read.
- Restrict egress from application hosts to LangSmith endpoints so that trace attachments cannot be transmitted while the patch is being rolled out.
- Run application workloads under a least-privilege service account whose filesystem read permissions exclude secrets, keys, and configuration files.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
