CVE-2026-59152: LangSmith SDK Arbitrary File Read via TracingMiddleware

Technical summary

CVE-2026-59152 is a path traversal and origin validation weakness (CWE-22, CWE-346) in LangSmith Client SDKs' TracingMiddleware. An HTTP request to a server running the middleware can trigger arbitrary file reads from the local filesystem. The contents are then uploaded as trace attachments to the LangSmith platform. The vulnerability bridges an authentication gap: while sending traces may not require authentication depending on deployment topology, extracting the exfiltrated file contents requires workspace trace-read permissions. This creates a privilege escalation scenario where workspace members gain unauthorized filesystem access on production servers. The flaw stems from insufficient input validation and origin checking in the middleware's trace attachment handling (CWE-843 - type confusion in HTTP request processing).

Business impact

This vulnerability enables insider threats and compromised-account scenarios to escalate beyond their intended scope. A contractor with read-only access to workspace traces, or a low-privilege team member, can extract sensitive files (configuration files, private keys, source code, credentials) from any production server running TracingMiddleware. Organizations using LangSmith for distributed tracing in multi-tenant or federated environments face particular risk, as the trust boundary collapse could expose files across multiple services. The ability to exfiltrate secrets and code without direct server access creates compliance and incident response challenges, especially in regulated environments.

Affected systems

LangSmith Client SDKs versions prior to 0.8.18 are affected. Any server deploying TracingMiddleware from a vulnerable SDK version is susceptible. The vulnerability does not require specific configurations or optional features to be enabled; it affects default deployments. Organizations should identify all services using LangSmith SDKs and check their installed versions. Both Python and multi-language SDK distributions are in scope if they include vulnerable middleware versions.

Exploitability

Exploitation requires network access to a server running TracingMiddleware and read access to the corresponding LangSmith workspace. In many deployments, sending trace data requires no authentication, meaning an internal network path or cross-origin request from a workspace member is sufficient. The actual extraction of file contents requires workspace-level permissions, making this primarily an insider-threat or compromised-account attack vector. No complex exploitation techniques are necessary; standard HTTP requests suffice. The attack is highly reliable and leaves traces in the tracing system itself, though those traces are only visible to workspace members.

Remediation

Upgrade all LangSmith Client SDKs to version 0.8.18 or later. Verify the upgrade across all services and deployment environments. As an interim mitigation, restrict network access to servers running TracingMiddleware—implement firewall rules, VPC isolation, or service-mesh policies to limit which clients can send trace data. Audit LangSmith workspace permissions and revoke unnecessary trace-read access from contractors, temporary team members, and service accounts. Review recent trace attachment uploads for signs of unauthorized file exfiltration.

Patch guidance

Apply the fix by upgrading to LangSmith Client SDK version 0.8.18 or newer. Check your package manager (pip for Python, npm for JavaScript, etc.) for the latest release. Test the upgrade in a staging environment first, as SDK updates may require code changes if APIs have evolved. Verify that tracing functionality continues to work after upgrade and that existing trace instrumentation is unaffected. Deploy the patched SDK across all production services running TracingMiddleware, including background jobs and microservices. Consider implementing automated dependency scanning to catch future vulnerable SDK versions early.

Detection guidance

Monitor HTTP requests sent to servers running TracingMiddleware for suspicious file paths in trace attachments—look for patterns like '../', encoded traversal sequences, or references to sensitive locations (/etc/passwd, environment files, key directories). Enable LangSmith API logging and audit which workspace members are accessing trace attachments containing filesystem content. Check for traces uploaded immediately after new credentials or configuration files were created. Review server access logs for 4xx errors that might indicate failed exploitation attempts. Use software composition analysis (SCA) tools to identify SDK versions in deployed applications and flag those below 0.8.18.

Why prioritize this

This is a MEDIUM-severity vulnerability that should be prioritized based on your organization's use of LangSmith and the sensitivity of files accessible to compromised or malicious workspace members. If you deploy TracingMiddleware in environments handling secrets, private keys, or source code, upgrade urgently. The vulnerability is not actively exploited at scale (not yet a KEV entry), but the low barrier to exploitation and high potential for sensitive data exfiltration warrant swift patching. Organizations with strict insider-threat controls or fully external workspaces may deprioritize slightly, but the fix is straightforward enough to apply across the board.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects a network-accessible vulnerability requiring low privileges (workspace read access) but with no impact on system availability or integrity—only confidentiality. The score appropriately captures the insider/compromised-account nature of the threat and the need for some level of prior access to the LangSmith workspace. However, organizations should consider context: if your workspace includes high-privilege members, contractors, or shared accounts, the practical severity may be higher. Conversely, if workspace access is strictly role-based and monitored, the real-world risk may be lower.

Frequently asked questions