CVE-2026-26013: LangChain ChatOpenAI SSRF via Image Token Counting

# CVE-2026-26013: LangChain ChatOpenAI SSRF via Image Token Counting

https://gcdradar.vercel.app/incidents/cve-2026-26013-langchain-chatopenai-ssrf-via-image-token-cou · AIR-2026-0468 · closed 2026-02-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-02-10 (happened 2026-02-11)
- AI role: Attack on AI
- Products: LangChain
- CVE ids: CVE-2026-26013
- CVSS: 3.7

## Summary

LangChain fetched arbitrary image URLs without validation during vision model token counting, leading to blind SSRF. The impact is limited due to timeouts and lack of response return to attackers.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-02-11: CVE-2026-26013: LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages (https://github.com/advisories/GHSA-2g6r-c272-w58r)
- 2026-02-10: CVE-2026-26013: LangChain is a framework for building agents and LLM-powered applications. (https://nvd.nist.gov/vuln/detail/CVE-2026-26013)

## Sources

- 2026-02-10 NVD: CVE-2026-26013: LangChain is a framework for building agents and LLM-powered applications. https://nvd.nist.gov/vuln/detail/CVE-2026-26013
- 2026-02-11 GitHub Advisory Database: CVE-2026-26013: LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages https://github.com/advisories/GHSA-2g6r-c272-w58r

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.