LangSmith SDK CVE-2026-59152

The target server must be running LangSmith SDK prior to 0.8.18 with TracingMiddleware active and processing incoming HTTP requests. Triggering the file read requires the ability to send HTTP requests to that server - the description explicitly states this may require no authentication depending on how the service is deployed (e.g., a publicly accessible or internally open endpoint). Retrieving the exfiltrated file contents requires read access to the specific LangSmith workspace that the server's traces are forwarded to, such as a low-privilege workspace member, contractor, or compromised team account. Exploitation is limited to files readable by the server process's OS user; a server running as a least-privilege user with a read-only filesystem mount significantly reduces accessible files. Non-default network segmentation preventing inbound HTTP from untrusted sources also limits trigger-side exposure.

The NVD-assigned CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) understates real-world impact for many deployments. The S:C metric correctly captures the trust escalation, but C:L likely reflects the constraint that retrieving the file requires workspace read access rather than the sensitivity of the file itself - in practice, arbitrary file read from a server process can expose SSH private keys, cloud credentials, .env secrets, and TLS certificates, making the confidentiality impact functionally high. The PR:L reflects workspace read access needed to retrieve the exfiltrated file; however, the description explicitly notes that triggering the file read (sending the malicious HTTP request) may not require authentication at all depending on deployment, creating a two-phase attack with a lower initial bar than PR:L implies. No EPSS data is available for this CVE, and it is not listed in CISA KEV - no confirmed active exploitation. The combination of low complexity, network accessibility, and high sensitivity of potentially reachable files elevates this above its nominal score for deployments with broadly granted workspace access.

A contractor with LangSmith workspace read access sends a crafted HTTP request to an internal microservice running TracingMiddleware, embedding a path traversal sequence targeting /run/secrets/db-password or /app/.env in a middleware-parsed field. The server reads the file and uploads its contents to LangSmith as a trace attachment. The contractor then opens the LangSmith workspace, navigates to the trace, and downloads the attachment containing the plaintext credential. No public proof-of-concept exploit has been identified at time of analysis.