LangChain Community CVE-2026-72848

The application must be using SitemapLoader from the langchain-community package to ingest sitemaps. The attacker must control or influence the content of a sitemap consumed by that application - this is satisfied when the pipeline accepts user-supplied sitemap URLs, crawls external websites, or loads sitemaps from third-party sources the attacker can modify or poison. The target sitemap must use the sitemap index format containing nested <sitemap> elements (rather than a flat <url> list), because the bypass exclusively affects the nested-entry processing loop. The deploying application must have set restrict_to_same_domain=True - if that flag is absent, no bypass occurs because no restriction was applied in the first place. Exploitation yields meaningful data only if the LangChain server has network-level access to internal resources (cloud metadata endpoints, intranet APIs, internal services); a fully network-isolated deployment would receive empty or refused responses. PR:N in the CVSS 4.0 vector confirms no authentication to the LangChain host is required. No special software version, operating system, or non-default runtime configuration beyond the above is needed.

The 7.7 CVSS 4.0 score is driven entirely by SC:H - the vulnerable system (the LangChain process) shows no self-impact (VC/VI/VA all N), accurately modelling SSRF: the application is co-opted as a proxy, with internal services as the actual disclosure targets. The attack vector is Network with no complexity, privilege, or interaction requirements, meaning every deployment ingesting attacker-influenced sitemaps is exposed without authentication. EPSS data was not supplied in the available intelligence; however, the combination of a straightforwardly reproducible bypass of a documented security control, the popularity of LangChain in production RAG and content-ingestion pipelines, and zero CVSS mitigating conditions suggests non-trivial exploitation probability in targeted attacks. The vulnerability is not listed in CISA KEV and no public exploit code has been confirmed, which distinguishes it from immediately weaponized threats - but the absence of KEV listing should not reduce urgency for teams running LangChain pipelines against third-party sitemaps. A CVSS 3.1 mapping of approximately 8.6 (S:C, C:H, I:N, A:N) is consistent with the 4.0 rating; no conflict between the two scoring systems was observed. This is a real priority for affected deployments, not a high-CVSS-but-low-real-risk issue: the code path is explicit, the bypass of an intentional control is confirmed, and cloud metadata endpoints (e.g., 169.254.169.254) are a proven SSRF target class.

An attacker who controls or has compromised a public website hosts a sitemap index file containing a nested <sitemap><loc>http://169.254.169.254/latest/meta-data/</loc></sitemap> entry pointing at the cloud instance metadata endpoint. When a LangChain RAG pipeline with restrict_to_same_domain=True processes this sitemap, the nested entry skips domain validation, triggering an aiohttp GET to the metadata endpoint; the response - potentially containing IAM credentials or instance identity documents - is deserialized and returned inside the pipeline's Document objects, disclosing it to whoever invoked the ingestion job. No public exploit code has been confirmed, but the attack path is directly derivable from the vulnerability description without additional reverse engineering.