Description
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary. This vulnerability is fixed in 0.8.18.
Published: 2026-07-06
Score: 5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An HTTP request to a server that has the LangSmith SDK’s TracingMiddleware enabled can trigger a read of any file present on the host. The middleware uploads the retrieved content to a LangSmith trace as an attachment, allowing a party with read access to workspace traces to obtain local file contents. The flaw is a classic arbitrary file read, causing a trust‑boundary crossing that exposes the server’s file system to attackers who are otherwise limited to trace‑view permissions.

Affected Systems

The vulnerability affects installations of the LangSmith client SDK from the vendor langchain‑ai, specifically any versions prior to 0.8.18. Any application built with this SDK that has TracingMiddleware active is potentially exposed.

Risk and Exploitability

The CVSS base score of 5 indicates moderate severity. The EPSS score is < 1%, suggesting a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote: an attacker can send a crafted HTTP request to the TracingMiddleware endpoint, potentially without authentication depending on the trace deployment. The exploit does not require elevated privileges, making it feasible for anyone who can reach the server and has workspace‑trace read rights.

Generated by OpenCVE AI on July 26, 2026 at 20:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the LangSmith SDK to version 0.8.18 or later to fix the arbitrary file read issue (CWE-22).
  • If an upgrade is not immediately possible, restrict the TracingMiddleware endpoint so that only authenticated requests can reach it or disable the middleware entirely (CWE-346).
  • After mitigation, review existing traces for uploaded attachments that may contain sensitive file contents and remove them, and enforce stricter workspace trace‑read permissions (CWE-843).

Generated by OpenCVE AI on July 26, 2026 at 20:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 07 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Langchain-ai
Langchain-ai langsmith-sdk
Vendors & Products Langchain-ai
Langchain-ai langsmith-sdk

Mon, 06 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary. This vulnerability is fixed in 0.8.18.
Title Arbitrary server-side file read in LangSmith SDK TracingMiddleware
Weaknesses CWE-22
CWE-346
CWE-843
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Langchain-ai Langsmith-sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-07T15:17:40.993Z

Reserved: 2026-07-02T16:50:27.886Z

Link: CVE-2026-59152

cve-icon Vulnrichment

Updated: 2026-07-07T15:17:36.796Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-06T14:26:55Z

Links: CVE-2026-59152 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T20:45:03Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-346

    Origin Validation Error

  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')