{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41481", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T16:14:19.006Z", "datePublished": "2026-04-24T20:54:27.713Z", "dateUpdated": "2026-04-25T01:54:16.304Z"}, "containers": {"cna": {"title": "LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr"}], "affected": [{"vendor": "langchain-ai", "product": "langchain-text-splitters", "versions": [{"version": "< 1.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T20:55:32.916Z"}, "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters\n 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The response body is parsed and returned as Document objects to the calling application code. Whether this constitutes a data exfiltration path depends on the application: if it exposes Document contents (or derivatives) back to the requester who supplied the URL, sensitive data from internal endpoints could be leaked. Applications that store or process Documents internally without returning raw content to the requester are not directly exposed to data exfiltration through this issue. This vulnerability is fixed in 1.1.2."}], "source": {"advisory": "GHSA-fv5p-p927-qmxr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-25T01:54:07.352480Z", "id": "CVE-2026-41481", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:54:16.304Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41481", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-25T01:54:07.352480Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:54:12.851Z"}}], "cna": {"title": "LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass", "source": {"advisory": "GHSA-fv5p-p927-qmxr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "langchain-ai", "product": "langchain-text-splitters", "versions": [{"status": "affected", "version": "< 1.1.2"}]}], "references": [{"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr", "name": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters\n 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The response body is parsed and returned as Document objects to the calling application code. Whether this constitutes a data exfiltration path depends on the application: if it exposes Document contents (or derivatives) back to the requester who supplied the URL, sensitive data from internal endpoints could be leaked. Applications that store or process Documents internally without returning raw content to the requester are not directly exposed to data exfiltration through this issue. This vulnerability is fixed in 1.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T20:55:32.916Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41481", "state": "PUBLISHED", "dateUpdated": "2026-04-25T01:54:16.304Z", "dateReserved": "2026-04-20T16:14:19.006Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T20:54:27.713Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:langchain:langchain-text-splitters:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B5FD4DD-C579-4824-8988-4C702E1B2D24", "versionEndExcluding": "1.1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters\n 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The response body is parsed and returned as Document objects to the calling application code. Whether this constitutes a data exfiltration path depends on the application: if it exposes Document contents (or derivatives) back to the requester who supplied the URL, sensitive data from internal endpoints could be leaked. Applications that store or process Documents internally without returning raw content to the requester are not directly exposed to data exfiltration through this issue. This vulnerability is fixed in 1.1.2."}], "id": "CVE-2026-41481", "lastModified": "2026-04-28T15:43:13.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-24T21:16:19.490", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass", "id": "2461733", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461733"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in LangChain and langchain-text-splitters. This vulnerability, a Server-Side Request Forgery (SSRF) bypass, allows a remote attacker to redirect a seemingly safe URL to internal network resources. By exploiting unvalidated redirects, an attacker could access sensitive data from internal, localhost, or cloud metadata endpoints. This could result in information disclosure or data exfiltration if the application processes and exposes the content from these redirected requests."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Red Hat customers should ensure that applications utilizing LangChain's HTMLHeaderTextSplitter.split_text_from_url() function do not process untrusted or unvalidated URLs. Implement strict input validation for all URL inputs to prevent redirection to internal network resources. If an application exposes the content of processed Document objects to external requesters, consider reconfiguring the application to restrict such exposure."}, "name": "CVE-2026-41481", "package_state": [{"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Fix deferred", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-service-api-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-25/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-llama-stack-core-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-04-24T20:54:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41481\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41481\nhttps://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr"], "statement": "This is an Important information disclosure flaw in LangChain and langchain-text-splitters, affecting Red Hat products that process URLs using these components. The vulnerability allows a Server-Side Request Forgery (SSRF) redirect bypass, where initial URL validation is circumvented by unvalidated redirect targets. This could enable an attacker to access internal network resources and potentially exfiltrate sensitive data if the application exposes the content from these redirected requests.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "langchain-text-splitters", "source": "cna", "vendor": "langchain-ai"}, "product": "langchain-text-splitters", "vendor": "langchain-ai"}], "analysis": {"en": {"generated_at": "2026-04-28T05:44:14.657947+00:00", "value": {"mitigation_remediation": ["Upgrade langchain-text-splitters to version\u202f1.1.2 or later. \n", "If an upgrade is not immediately possible, modify the library or application code to disable automatic redirects or to revalidate any redirect targets before fetching. \n", "Enforce network segmentation or firewall rules that block outbound connections to internal or localhost addresses from the process that calls split_text_from_url."], "summary": {"action": "Immediate Patch", "impact": "SSRF redirect bypass that can expose internal data"}, "threat_synthesis": {"affected_systems": "This issue affects installations of langchain-text-splitters older than version\u202f1.1.2 on any platform where the application can invoke split_text_from_url. The fix is included in release\u202f1.1.2. Users of langchain-text-splitters before that version are vulnerable.", "description_and_impact": "The vulnerability resides in the HTMLHeaderTextSplitter.split_text_from_url method, which validates the original URL but then follows HTTP redirects without revalidation. An attacker who can supply a URL can direct the library to redirect to an internal or localhost address. If the application returns the resulting Document object to the requester, sensitive data from internal services could be exfiltrated. If the application simply stores or processes the Document internally without exposing its contents, the risk is limited to a typical SSRF scenario. The weakness is a Server\u2011Side Request Forgery flaw identified as CWE\u2011918.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1\u202f% suggests a very low probability of exploitation at this time. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to provide a URL to the vulnerable function, which then performs a redirection to an internal service. The undefined nature of the application\u2019s handling of returned Documents affects the overall impact; if the contents are exposed to the user, the damage could be significant, otherwise only SSRF occurs."}}}}, "created": "2026-04-28T05:45:23.303357+00:00", "updated": "2026-04-28T09:17:43.827775+00:00", "vendors": ["langchain-ai", "langchain-ai$PRODUCT$langchain-text-splitters"]}