CVE-2025-2828

The vulnerability stems from lack of validation of target URLs in the langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit component. The toolkit executes HTTP requests to both remote and local network addresses, not distinguishing between traffic to the internet and traffic directed to internal infrastructure. An attacker can craft a malicious request that will be forwarded by the server to local services or instance metadata endpoints (e.g., AWS EC2 Metadata Service, Azure Instance Metadata Service). This results in unauthorized access to resources not directly accessible from the outside.

An attacker can perform internal network port scanning, gain access to local services, and retrieve sensitive cloud instance metadata (including access keys, authentication tokens) from environments such as AWS or Azure. Combined with a maximum CVSS score of 10.0 and a scope exceeding the attacked application (Scope: Changed), the consequences may include complete takeover of the cloud environment.

Update the langchain-community package to version 0.0.28 or later, in which the issue has been fixed. The fix is available in the project repository (commit e188d4ecb085d4561a0be3c583d26aa9c2c3283f).

langchain-community version 0.0.27 (langchain-ai/langchain package), component langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit