Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-45134: LangSmith SDK deserializes public Hub prompt manifests as trusted, enabling SSRF and credential theft

AIR-2026-0104 AIR record · 2026-05-langsmith-sdk-public-prompt-pull
Open in dashboard About
From the supporting source
the manifest content is controlled by an external partygithub.com
The record
Disclosed
2026-05-07
Vendor
LangChain Inc.
Product
LangSmith SDK, langchain, langchain-classic
Risk domain
Access control and permissions › Confused deputy
Also touches
Credential theft, Supply chain vulnerabilities
System type
Generative model
Who acted
AI was the target — the SDK deserializes public Hub manifests as trusted
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Malicious public prompt in langsmith hub
Impact type
Ssrf, Credential theft, Response manipulation
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0054 – LLM Jailbreak
NIST AI RMF
GOVERN 6.1
EU AI Act
—
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Validate delegation chains; Use signed attestations.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
langchain < 0.3.30, langchain-classic < 1.0.7, langsmith pip < 0.8.0, langsmith npm < 0.6.0
Capability abused
prompt_hub_pullllm_client_configuration
Defense & remediation
Recorded defense
none - external prompts were treated as trusted code with no warning
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
langchain 0.3.30, langchain-classic 1.0.7, langsmith 0.8.0 (pip) / 0.6.0 (npm); public pulls now require an explicit dangerously_pull_public_prompt flag
Taxonomy & references
OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI03 Identity and Privilege AbuseCVE-2026-45134supply_chainuntrusted_manifesttrust_boundaryssrfagent_registry
Curator notes
GHSA-3644-q5cj-c5c7, CVSS 7.1 High, published 2026-05-07. This is the SDK-side recurrence of the 2024/2025 AgentSmith issue: an attacker publishes a prompt that configures the LLM client with an attacker-controlled endpoint. The fix is a mandatory opt-in flag rather than a sanitizer, which is a notable design admission about untrusted agent artifacts.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-45134: LangSmith SDK deserializes public Hub prompt manifests as trusted, enabling SSRF and credential theft". AIR, AIR-2026-0104. https://agentincident.vercel.app/i/AIR-2026-0104/ (accessed 2026-10-19).