CVE-2026-41481

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Published

Apr 24, 2026, 8:54:27 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.26% · Oct 25, 2026

A flaw was found in LangChain and langchain-text-splitters. This vulnerability, a Server-Side Request Forgery (SSRF) bypass, allows a remote attacker to redirect a seemingly safe URL to internal network resources. By exploiting unvalidated redirects, an attacker could access sensitive data from internal, localhost, or cloud metadata endpoints. This could result in information disclosure or data exfiltration if the application processes and exposes the content from these redirected requests. langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass This is an Important information disclosure flaw in LangChain and langchain-text-splitters, affecting Red Hat products that process URLs using these components. The vulnerability allows a Server-Side Request Forgery (SSRF) redirect bypass, where initial URL validation is circumvented by unvalidated redirect targets. This could enable an attacker to access internal network resources and potentially exfiltrate sensitive data if the application exposes the content from these redirected requests. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.