{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-34070", "tracking": { "current_release_date": "2026-04-03T15:34:55.862157Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-34070", "initial_release_date": "2026-03-27T19:41:37.719238Z", "revision_history": [ { "date": "2026-03-27T19:41:37.719238Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Products created (1).| References created (3)." }, { "date": "2026-03-27T19:41:42.149667Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-27T21:35:09.717785Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-03-27T21:35:19.286804Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-31T02:38:48.887846Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)." }, { "date": "2026-03-31T02:38:50.466907Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-31T03:25:25.409643Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-31T03:25:27.521798Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-03-31T07:35:21.106175Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-31T16:55:41.030463Z", "number": "10", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-31T16:55:43.727442Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-31T18:38:53.941302Z", "number": "12", "summary": "Unknown change." }, { "date": "2026-03-31T19:55:15.620516Z", "number": "13", "summary": "References created (1)." }, { "date": "2026-04-01T00:27:42.613355Z", "number": "14", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (10).| Product Identifiers created (4).| Product Remediations created (12).| Products created (2).| References created (5).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-04-01T00:27:49.564034Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-04-01T07:29:16.813537Z", "number": "16", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products created (1)." }, { "date": "2026-04-01T07:29:21.310409Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-04-02T17:25:39.342212Z", "number": "18", "summary": "Products created (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-04-02T17:25:40.945330Z", "number": "19", "summary": "NCSC Score updated." }, { "date": "2026-04-03T15:31:59.849253Z", "number": "20", "summary": "EPSS updated." }, { "date": "2026-04-03T15:32:02.471221Z", "number": "21", "summary": "NCSC Score updated." } ], "status": "interim", "version": "21" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.2.22", "product": { "name": "vers:unknown/<1.2.22", "product_id": "CSAFPID-5941270" } } ], "category": "product_name", "name": "LangChain" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/8", "product": { "name": "vers:rpm/8", "product_id": "CSAFPID-4994901", "product_identification_helper": { "cpe": "cpe:/a:redhat:migration_toolkit_applications:8" } } } ], "category": "product_name", "name": "Migration Toolkit for Applications 8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2524222", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_lightspeed" } } } ], "category": "product_name", "name": "OpenShift Lightspeed" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/2", "product": { "name": "vers:rpm/2", "product_id": "CSAFPID-1508257", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_automation_platform:2" } } } ], "category": "product_name", "name": "Red Hat Ansible Automation Platform 2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1439279", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5969703" } } ], "category": "product_name", "name": "art-images" } ], "category": "product_family", "name": "Migration Toolkit for Applications 8" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2831634" } } ], "category": "product_name", "name": "lightspeed-chatbot-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1508261" } } ], "category": "product_name", "name": "lightspeed-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5009266" } } ], "category": "product_name", "name": "lightspeed-rhel9" } ], "category": "product_family", "name": "Red Hat Ansible Automation Platform 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5969704" } } ], "category": "product_name", "name": "lightspeed-service" } ], "category": "product_family", "name": "OpenShift Lightspeed" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3112099" } } ], "category": "product_name", "name": "odh-llama-stack-core-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5811359" } } ], "category": "product_name", "name": "odh-mlflow-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5834017" } } ], "category": "product_name", "name": "odh-trustyai-nemo-guardrails-server-rhel9" } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.2.22", "product": { "name": "vers:unknown/<1.2.22", "product_id": "CSAFPID-5985066", "product_identification_helper": { "cpe": "cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "langchain" } ], "category": "vendor", "name": "langchain" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.2.22", "product": { "name": "vers:unknown/<1.2.22", "product_id": "CSAFPID-5966417" } } ], "category": "product_name", "name": "langchain" } ], "category": "vendor", "name": "langchain-ai" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.2.22", "product": { "name": "vers:unknown/<1.2.22", "product_id": "CSAFPID-5970865" } } ], "category": "product_name", "name": "langchain-core" } ], "category": "vendor", "name": "unknown" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-34070", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "## Summary\n\nMultiple functions in `langchain_core.prompts.loading` read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to `load_prompt()` or `load_prompt_from_config()`, an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (`.txt` for templates, `.json`/`.yaml` for examples).\n\n**Note:** The affected functions (`load_prompt`, `load_prompt_from_config`, and the `.save()` method on prompt classes) are undocumented legacy APIs. They are superseded by the `dumpd`/`dumps`/`load`/`loads` serialization APIs in `langchain_core.load`, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0.\n\n## Affected component\n\n**Package:** `langchain-core`\n**File:** `langchain_core/prompts/loading.py`\n**Affected functions:** `_load_template()`, `_load_examples()`, `_load_few_shot_prompt()`\n\n## Severity\n\n**High** \n\nThe score reflects the file-extension constraints that limit which files can be read.\n\n## Vulnerable code paths\n\n| Config key | Loaded by | Readable extensions |\n|---|---|---|\n| `template_path`, `suffix_path`, `prefix_path` | `_load_template()` | `.txt` |\n| `examples` (when string) | `_load_examples()` | `.json`, `.yaml`, `.yml` |\n| `example_prompt_path` | `_load_few_shot_prompt()` | `.json`, `.yaml`, `.yml` |\n\nNone of these code paths validated the supplied path against absolute path injection or `..` traversal sequences before reading from disk.\n\n## Impact\n\nAn attacker who controls or influences the prompt configuration dict can read files outside the intended directory:\n\n- **`.txt` files:** cloud-mounted secrets (`/mnt/secrets/api_key.txt`), `requirements.txt`, internal system prompts\n- **`.json`/`.yaml` files:** cloud credentials (`~/.docker/config.json`, `~/.azure/accessTokens.json`), Kubernetes manifests, CI/CD configs, application settings\n\nThis is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose `load_prompt_from_config()`.\n\n## Proof of concept\n\n```python\nfrom langchain_core.prompts.loading import load_prompt_from_config\n\n# Reads /tmp/secret.txt via absolute path injection\nconfig = {\n \"_type\": \"prompt\",\n \"template_path\": \"/tmp/secret.txt\",\n \"input_variables\": [],\n}\nprompt = load_prompt_from_config(config)\nprint(prompt.template) # file contents disclosed\n\n# Reads ../../etc/secret.txt via directory traversal\nconfig = {\n \"_type\": \"prompt\",\n \"template_path\": \"../../etc/secret.txt\",\n \"input_variables\": [],\n}\nprompt = load_prompt_from_config(config)\n\n# Reads arbitrary .json via few-shot examples\nconfig = {\n \"_type\": \"few_shot\",\n \"examples\": \"../../../../.docker/config.json\",\n \"example_prompt\": {\n \"_type\": \"prompt\",\n \"input_variables\": [\"input\", \"output\"],\n \"template\": \"{input}: {output}\",\n },\n \"prefix\": \"\",\n \"suffix\": \"{query}\",\n \"input_variables\": [\"query\"],\n}\nprompt = load_prompt_from_config(config)\n```\n\n## Mitigation\n\n**Update `langchain-core` to >= 1.2.22.**\n\nThe fix adds path validation that rejects absolute paths and `..` traversal sequences by default. An `allow_dangerous_paths=True` keyword argument is available on `load_prompt()` and `load_prompt_from_config()` for trusted inputs.\n\nAs described above, these legacy APIs have been formally deprecated. Users should migrate to `dumpd`/`dumps`/`load`/`loads` from `langchain_core.load`.\n\n## Credit\n\n- [jiayuqi7813](https://github.com/jiayuqi7813) reporter\n- [VladimirEliTokarev](https://github.com/VladimirEliTokarev) reporter\n- [Rickidevs](https://github.com/Rickidevs) reporter\n- Kenneth Cox (cczine@gmail.com) reporter", "title": "github - https://api.github.com/advisories/GHSA-qh6h-p6c9-ff54" }, { "category": "description", "text": "LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34070.json" }, { "category": "description", "text": "LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34070" }, { "category": "description", "text": "A flaw was found in LangChain. Multiple functions in `langchain_core.prompts.loading` read files from paths embedded in deserialized configuration dictionaries without validation for directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to `load_prompt()` or `load_prompt_from_config()`, an attacker can read arbitrary files on the host filesystem.\nThis flaw is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose `load_prompt_from_config()`.\nAlso, the affected functions (`load_prompt`, `load_prompt_from_config`, and the `.save()` method on prompt classes) are undocumented legacy APIs. They are superseded by the `dumpd`/`dumps`/`load`/`loads` serialization APIs in `langchain_core.load`, which do not perform filesystem reads and use an allowlist-based security model.\nAn attacker who controls or influences the prompt configuration dictionary can read files outside the intended directory, such as cloud-mounted secrets, internal system prompts, cloud credentials, Kubernetes manifests, CI/CD configs, application settings.\nDue to these reasons, this vulnerability has been rated with an important severity.", "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34070.json" }, { "category": "description", "text": "Affected versions of the langchain-core package are vulnerable to Path Traversal due to improper validation of file paths embedded in deserialized prompt configuration dictionaries. The load_prompt() and load_prompt_from_config() functions in langchain_core.prompts.loading, through _load_template(), _load_examples(), and _load_few_shot_prompt(), read attacker-influenced values such as template_path, suffix_path, prefix_path, examples, and example_prompt_path without blocking absolute paths or .. traversal sequences before accessing .txt, .json, or .yaml files on disk.", "title": "pyupio - https://raw.githubusercontent.com/pyupio/safety-db/refs/heads/master/data/insecure_full.json" }, { "category": "other", "text": "0.00048", "title": "EPSS" }, { "category": "other", "text": "4.8", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde, Is related to (a version of) an uncommon product", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is exploit data available from source Nvd, Is related to a product by vendor Red Hat, Is related to a product by vendor Unknown", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-5941270", "CSAFPID-5966417", "CSAFPID-1439279", "CSAFPID-1508257", "CSAFPID-1508261", "CSAFPID-2524222", "CSAFPID-2831634", "CSAFPID-3112099", "CSAFPID-4994901", "CSAFPID-5009266", "CSAFPID-5834017", "CSAFPID-5969703", "CSAFPID-5969704", "CSAFPID-5970865", "CSAFPID-5985066" ], "known_not_affected": [ "CSAFPID-5811359" ] }, "references": [ { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0896.json" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-qh6h-p6c9-ff54" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34070.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34070" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34070.json" }, { "category": "external", "summary": "Source - pyupio", "url": "https://raw.githubusercontent.com/pyupio/safety-db/refs/heads/master/data/insecure_full.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0896.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0896" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; github; nvd; redhat", "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; redhat", "url": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; redhat", "url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-qh6h-p6c9-ff54" }, { "category": "external", "summary": "Reference - github; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34070" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34070" } ], "remediations": [ { "category": "mitigation", "details": "As described in the statement section, the vulnerable methods are legacy APIs and their use should be avoided. To mitigate this issue, the dumpd, dumps, load and loads methods from langchain_core.load should be used, as they supersede the legacy API and provide a more secure serialization model.", "product_ids": [ "CSAFPID-1439279", "CSAFPID-1508257", "CSAFPID-1508261", "CSAFPID-2524222", "CSAFPID-2831634", "CSAFPID-3112099", "CSAFPID-4994901", "CSAFPID-5009266", "CSAFPID-5811359", "CSAFPID-5834017", "CSAFPID-5969703", "CSAFPID-5969704" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1439279", "CSAFPID-1508257", "CSAFPID-1508261", "CSAFPID-2524222", "CSAFPID-2831634", "CSAFPID-3112099", "CSAFPID-4994901", "CSAFPID-5009266", "CSAFPID-5834017", "CSAFPID-5941270", "CSAFPID-5966417", "CSAFPID-5969703", "CSAFPID-5969704", "CSAFPID-5970865", "CSAFPID-5985066" ] } ], "title": "CVE-2026-34070" } ] }