Description
The LangSmith SDK’s distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the baggage header, causing the SDK to exfiltrate sensitive trace data to attacker-controlled endpoints.
Recommendation
Update the langsmith package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.3.41, < 0.4.6
- Patched version(s): 0.4.6
References
Could your website be exposed too?
SmartScanner can check your website for LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
- jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions - CVE-2026-25535
- HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis - CVE-2026-46391
- @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints - CVE-2026-53513
You might also like:
See something that needs correcting? Let us knowUpdated February 09, 2026