Disclosed vulnerability
CVE-2026-44843: LangChain core load() allowlists let attacker-controlled data instantiate trusted classes
AIR-2026-0102 AIR record · 2026-05-langchain-core-load-allowlist-deserialization
From the supporting source
attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments.github.com
The record
Disclosed
2026-05-05
Vendor
LangChain Inc.
Product
langchain-core
Risk domain
Access control and permissions › Credential theft
System type
Generative model
Who acted
AI was the target — an allowlist that constrains class names but not constructor arguments
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Attacker controlled structured input in chat history or run io
Impact type
Object injection, Credential disclosure, Prompt injection
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
langchain-core <= 0.3.84 and >= 1.0.0 <= 1.3.2 in apps using RunnableWithMessageHistory, astream_log() or astream_events(version="v1")
Capability abused
Defense & remediation
Recorded defense
an object allowlist intended to restrict deserialization to trusted LangChain classes
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
langchain-core 1.3.3 and 0.3.85
Taxonomy & references
Curator notes
GHSA-pjwx-r37v-7724, CVSS 8.2 High. The allowlist was scoped to class names but not to constructor arguments. Consequences listed by LangChain: chat-history poisoning, prompt injection, credential disclosure, and instantiation of unexpected objects.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-44843: LangChain core load() allowlists let attacker-controlled data instantiate trusted classes". AIR, AIR-2026-0102. https://agentincident.vercel.app/i/AIR-2026-0102/ (accessed 2026-10-19).