Skip to content
Fencer Vulns
high 7.5

CVE-2026-34070 json

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

published 2026-03-27 7 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-17283 , GHSA-qh6h-p6c9-ff54 , PYSEC-2026-2193

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.

Patch / fix

  • pypi langchain-core 1.2.22
  • Red Hat Red Hat Ansible Automation Platform 2.5 1780082949, 1787229385
  • Red Hat Red Hat OpenShift AI 3.3 1782471587, 1782471606

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34070 updated cvss 7.5

langchain: path traversal in legacy load_prompt functions in langchain-core

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9, ansible-automation-platform-25/lightspeed-chatbot-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1780082949, ansible-automation-platform-25/lightspeed-rhel8 1787229385
    fixed: vendor fix RHSA-2026:24766
  • Red Hat OpenShift AI 3.3 rhoai/odh-llama-stack-core-rhel9 1782471587, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1782471606
    fixed: vendor fix RHSA-2026:37275
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1779772027, ansible-automation-platform-25/hub-rhel8 1787101922, ansible-automation-platform-25/gateway-rhel8 1779788582, ansible-automation-platform-25/gateway-rhel8 1787100608, ansible-automation-platform-25/hub-web-rhel8 1779773575, ansible-automation-platform-25/hub-web-rhel8 1787185021, +46 more
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9/odh-mlflow-rhel9
    not affected: component not present
  • Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1782471642, rhoai/rhai-cli-rhel9 1782471642, rhoai/odh-mlflow-rhel9 1782917849, rhoai/odh-trainer-rhel9 1782471656, rhoai/odh-maas-api-rhel9 1782996644, rhoai/odh-mlserver-rhel9 1782887848, +75 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

1.44% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi langchain-core
<1.2.22
1.2.22

Affected products

  • langchain-ai langchain
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Lightspeed
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.