CVE-2026-41481Medium· 6.5▾ Sunlit

langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass (CVE-2026-41481)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Apr 24, 2026

Updated

Oct 15, 2026

CVSS

6.5

Vendor

Red Hat

Product

Red Hat Ansible Automation Platform 2

CWE

CWE-918

Depth score

36 · Low

EPSS

0.26% · p18

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 174 days

Apr 24, 2026Published
Disclosed via CSAF
Sep 12, 2026EPSS first tracked
0.3%
Sep 25, 2026EPSS peak
0.3% → 0.4%
Oct 15, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-918 #csaf #vex #red-hat #osv #pip

Affected

Patched in

langchain-text-splitters 1.1.2

Full technical detail▾

Overview

A flaw was found in LangChain and langchain-text-splitters. This vulnerability, a Server-Side Request Forgery (SSRF) bypass, allows a remote attacker to redirect a seemingly safe URL to internal network resources. By exploiting unvalidated redirects, an attacker could access sensitive data from internal, localhost, or cloud metadata endpoints. This could result in information disclosure or data exfiltration if the application processes and exposes the content from these redirected requests.

Vendor advisories

Red Hat VEX · Important · affected: Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · vex

langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass — rated Important by Red Hat. Released 2026-04-24, updated 2026-10-15.

Affected:

Migration Toolkit for Applications 8
OpenShift Lightspeed
Red Hat Ansible Automation Platform 2
Red Hat OpenShift AI (RHOAI)

No fix planned:

Migration Toolkit for Applications 8
OpenShift Lightspeed
Red Hat Ansible Automation Platform 2
Red Hat OpenShift AI (RHOAI)

Remediation

Fix deferred

Workarounds / mitigations:

To mitigate this issue, Red Hat customers should ensure that applications utilizing LangChain's HTMLHeaderTextSplitter.split_text_from_url() function do not process untrusted or unvalidated URLs. Implement strict input validation for all URL inputs to prevent redirection to internal network resources. If an application exposes the content of processed Document objects to external requesters, consider reconfiguring the application to restrict such exposure.

Package advisory (CVE-2026-41481)

Affected packages:

langchain-text-splitters < 1.1.2

Patched in:

langchain-text-splitters 1.1.2

Source: https://osv.dev/vulnerability/GHSA-fv5p-p927-qmxr

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip

← Back to feed