LangChain vulnerability allows information disclosure

CERT-Bund has released security advisory WID-SEC-2026-0896 detailing a critical vulnerability in the LangChain open-source framework. The flaw, rated with a CVSS base score of 7.5 (high), allows remote, anonymous attackers to exploit the system and disclose sensitive information. This advisory impacts all versions of LangChain prior to 1.2.22, running on various operating systems including UNIX and Windows.

Organizations utilizing LangChain should immediately review their deployed versions and apply available mitigations. The advisory indicates that affected systems include open-source LangChain versions less than 1.2.22. While a specific compliance deadline is not provided, prompt action is recommended to patch or update the framework to prevent potential information disclosure and mitigate security risks.