CVE-2026-25528 affected applications that passed untrusted HTTP tracing headers into the LangSmith SDK. A crafted baggage header could add an attacker-controlled replica URL; when a traced operation finished, the SDK sent run data to that destination. Inputs, outputs, and application metadata could therefore leave through a feature intended for observability. The flaw shows that tracing context is active routing authority, not harmless metadata.
ASSESSED SYSTEM
An affected application that passed untrusted HTTP tracing headers into vulnerable LangSmith Python or npm SDK versions and exported traced run data after request completion.
OUT OF SCOPE
Applications that never propagated untrusted headers into tracing context, fixed SDK versions, and claims that a particular secret was stolen without evidence it appeared in a trace.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — The system connects model workflow telemetry to an external service; the failure is a routing side effect rather than autonomous multi-step planning. Tier 1: Tier 1 because model inputs, outputs, tool metadata, and application context can include production-sensitive data and the injected route may also target internal services.
Documented attack or failure path
- The vulnerable condition was untrusted header propagation. Applications were exposed when TracingMiddleware accepted public request headers, or code passed them to RunTree.from_headers() or RunTree.fromHeaders() . Using LangSmith without that path was not enough.
- The baggage header carried destination authority. An attacker could add a replica object containing an api_url . Vulnerable SDK versions stored it as tracing configuration, then post() and patch() sent run data to the injected URL after the traced work completed. The same control could target an internal URL as SSRF.
- The fix removed unsafe inherited fields. Python versions from 0.4.10 to below 0.6.3 and npm versions from 0.3.41 to below 0.4.6 were affected. Fixed SDKs allowlist safe replica fields and discard caller-controlled destination and credential fields.
- The evidence does not prove a specific secret was stolen. A secret is exposed only if it was present in the exported run. There is currently no public evidence that this method has been used in an actual attack.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The flaw required applications to propagate untrusted tracing headers; ordinary LangSmith use without that path was not sufficient.
- Fixed SDKs allowlist safe replica fields and discard caller-controlled destination and credential fields.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Transparency (Tr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 1 MVT 0.55 indeterminate | |||
| Tr-3Audit Trail Completeness | 0.25w 0.25 | The 0.25 anchor: basic telemetry was present, but integrity and custody of the audit route were not protected from request input. | Tracing existed and recorded workflow activity, yet a caller-controlled baggage field could redirect that evidence to an attacker-controlled replica URL.source: primary/brief |
| Privacy (Pr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 1 MVT 0.60 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.25 | The 0.25 anchor: tracing served a legitimate operational purpose, but the exported data set and destination authority were broader than a minimally necessary fixed route. | The exported run could contain model inputs, outputs, and application metadata; public evidence does not show a pre-export minimization policy for the vulnerable path.source: primary/brief |
| Containment (Cn) — scenario interval 0.09–0.73 (midpoint 0.41), Tier 1 MVT 0.65 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.16 | The 0.25 anchor: the tracing subsystem had an intended endpoint scope, but untrusted request metadata could expand it to arbitrary external or internal destinations. | A crafted baggage header supplied api_url authority that vulnerable SDKs stored as tracing configuration and later used for post() and patch() exports.source: primary/brief |
| Cn-3Output Filtering Robustness | 0.25w 0.20 | The 0.25 anchor: normal trace serialization existed, but adaptive structured metadata could launder sensitive output to an unsafe sink. | Run data left through an observability exporter without a fail-closed safe-field allowlist and approved-destination release check in affected SDK versions.source: primary/brief |
Unknown, not N/A: 19 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.35 | Placed from the demonstrated decision and action authority of the assessed boundary; public evidence supports this bounded level but not a broader claim about current product defaults. |
| AsAttack Surface Exposure | 1.00w 0.25 | Placed from who can supply the initiating content or protocol message and from the trust status of that source in the documented configuration. elevated |
| CpCascade Potential | 1.00w 0.25 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.00w 0.15 | Placed from the documented remediation class: deterministic package/configuration change where available, otherwise provider, architecture, or multi-layer changes. It does not assert fleet-wide closure. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | The public record identifies the affected product or representative configuration, attack path, and principal control boundaries, but does not provide a complete asset manifest, verified dependency graph, configuration export, or assessment evidence manifest. |
| Ec — Public evaluation coverage | 0.17 | coverage 0.17 (4 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.01 | Evidence dated 2026-02-09; age 185 days on the workpaper reference date. Components: T_calendar 0.01 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. Evidence age is measured from 2026-02-09 to the 2026-08-13 workpaper reference date. Public sources do not provide a passing containment or behavioral re-attestation receipt; event, monitoring, and unresolved-evidence caps remain diagnostic only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.09 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.08.05. Inventory the Python and npm LangSmith SDK versions actually loaded by each service, rebuild on the current supported releases, stage rollout, and use runtime or image readback to prove vulnerable packages have exited. This removes the SDK behavior that accepted a caller-controlled replica destination. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Ro-4 Tr-4 |
| AID-H-032.003 | Inference Telemetry & Debug Surface RestrictionAIDEFEND dataVersion 2026.08.05. Before any trace leaves the inference service, suppress or redact prompts, outputs, retrieved context, tool arguments, secrets, and unnecessary metadata, then fail closed if the exporter cannot prove the policy is active. This reduces what an injected or misconfigured destination can receive, but it does not repair destination selection. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-4 Pr-2 Pr-4 |
| AID-I-002.002 | Secure External AI Service ConnectivityAIDEFEND dataVersion 2026.08.05. Give tracing workloads default-deny egress and allow only approved LangSmith endpoints through verified DNS and SNI policy. An attacker-controlled replica URL, or an internal metadata destination, then fails at a network boundary independent of the SDK parser. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-4 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationAIDEFEND dataVersion 2026.08.05. At request ingress, parse baggage with a strict schema and a safe-field allowlist, reject unknown replica fields, and remove caller-controlled api_url , api_key , or equivalent authority before tracing context is created. This is structured-header validation, not a prompt-injection filter. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Fa-1 Fa-3 Ro-1 |
WHAT THIS CASE TEACHES
Observability metadata is routing authority when it can select an exporter; trace context must be schema-restricted, destination-pinned, and minimized before export.
Sources: AIDEFEND in Action — LangSmith Tracing Header Injection Turned Observability Metadata into a Data Route · Primary source — Server-Side Request Forgery via Tracing Header Injection