Is CVE-2026-41488 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41488 being exploited in the wild.

How severe is CVE-2026-41488?

Low severity, with a CVSS score of 3.1, published 24 April 2026.

Which products and versions are affected?

langchain-openai (PyPI) < 1.1.14, ECOSYSTEM:introduced=0,fixed=1.1.14.

Is there a fix for CVE-2026-41488?

Yes. langchain-openai (PyPI): upgrade to 1.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41488 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41488?

Check whether you run Langchain-Openai or langchain-openai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41488: LangChain langchain-openai SSRF bypass via DNS rebinding in _url_to_size

Q: Is there a fix for CVE-2026-41488?

Yes. langchain-openai (PyPI): upgrade to 1.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41488 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-41488?

Check whether you run Langchain-Openai or langchain-openai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41488 · Severity: low · CVSS 3.1 · Published 2026-04-24

A vulnerability in the langchain-openai library could allow an attacker to bypass security protections and make the software connect to internal network services. This occurs when the library attempts to count tokens in an image by fetching it from a URL. While an attacker cannot steal data from these internal services, they could potentially use this flaw to map out internal network infrastructure or identify open ports on private servers.

Vendors: LangChain, PyPI.

Quick answers

Is CVE-2026-41488 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41488 being exploited in the wild.
How severe is CVE-2026-41488?: Low severity, with a CVSS score of 3.1, published 24 April 2026.
Which products and versions are affected?: langchain-openai (PyPI) < 1.1.14, ECOSYSTEM:introduced=0,fixed=1.1.14.
Is there a fix for CVE-2026-41488?: Yes. langchain-openai (PyPI): upgrade to 1.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41488 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41488?: Check whether you run Langchain-Openai or langchain-openai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

langchain-openai (PyPI): upgrade to 1.1.14 or later
```
pip install "langchain-openai>=1.1.14"
```

Technical details

The `_url_to_size()` helper in `langchain_openai` (used for image token counting) implements a 'validate-then-fetch' pattern with separate DNS resolutions. This creates a Time-of-Check Time-of-Use (TOCTOU) window where an attacker-controlled hostname can resolve to a public IP during validation and a private/localhost IP during the actual fetch (DNS rebinding). While the fetched content is only passed to Pillow's `Image.open()` and not returned to the user, an attacker can perform blind SSRF to probe internal network availability. The vulnerability is fixed in version 1.1.14 by using an SSRF-safe transport that pins the connection to a validated IP and disables redirects.

Affected products

LangChain AI langchain-openai < 1.1.14

Identifiers

CVE-2026-41488
GHSA-r7w7-9xr2-qq2r
PYSEC-2026-76

Timeline

2026-04-16: disclosed
2026-04-16: advisory
2026-04-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.