CVE-2026-25750

CVE-2026-25750 describes a URL parameter injection vulnerability in LangSmith Studio, affecting both LangSmith Cloud and self-hosted deployments of Langchain applications using Helm charts prior to version 0.12.71. This flaw allows unauthorized access to user accounts through stolen authentication tokens. The vulnerability carries a high CVSS score of 8.5, indicating a significant risk. It requires user interaction (social engineering) to trick authenticated users into clicking a specially crafted malicious link, which then transmits their bearer token, user ID, and workspace ID to an attacker-controlled server. While stolen tokens expire after 5 minutes, an attacker could impersonate the victim and access their LangSmith resources. There is currently no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness.