StackRadarChart IndexLive demo

CVE-2026-26013

Low

Advisory

Published 11 Feb 2026In the index since 6 Sept 2026

Severity: Low; worst across findings
CVSS: 3.7; base score, highest
EPSS: 0.004; 33rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 19; of 17,781 indexed, latest versions
Container images: 17; deployed by those charts
Fix available: 1 of 1; affected package

LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 17 images.

Affected package	Affected versions	Fixed in	Images
langchain-corepypi	0.1.23, 0.1.52, 0.2.22, 0.3.1+7 more	1.2.11	17

OSV records: GHSA-2g6r-c272-w58r
Also known as: PYSEC-2026-2562

Charts affected

19 by stars

Chart

Latest

Affected images

Radar Score

convertigoconvertigo

1 of 5 See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
baserow/baserow :1.30.1	df0c42eb67e8	langchain-core@0.1.52	1.2.11

Open the chart page →

17,404

cosmotech-copilot-apicosmotech-api

1 of 1 See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	langchain-core@0.1.23	1.2.11

Open the chart page →

11,205

streamlit-appstreamlit-app

1 of 1 See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
sruthitanneru/pi-sample :ui-latest	e565ea454ffd	langchain-core@0.3.21	1.2.11

Open the chart page →

1,696

tocktock

1 of 9 See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
tock/gen-ai-orchestrator-server :25.10.7	abf7880e0449	langchain-core@0.3.83	1.2.11

Open the chart page →

12,907

baserowblackbird-cloud

1 of 6 See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
baserow/backend :1.31.1	e0b3c8130b91	langchain-core@0.1.52	1.2.11

Open the chart page →

10,145

chat-searchchat-search

1 of 1 See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
ghcr.io/hemslo/chat-search :latest	39d48995a5bd	langchain-core@0.2.22	1.2.11

Open the chart page →

4,042

csghubcsghub

1 of 34 See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	langchain-core@0.3.72	1.2.11

Open the chart page →

58,897

ilum-streamlitilum

1 of 1 See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
ilum/streamlit-example :1.0.0	ce5dcdeb22ba	langchain-core@1.1.0	1.2.11

Open the chart page →

2,736

guardrails-usvcinfracloud-charts

1 of 1 See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/guardrails-tgi :latest	f68bec6a1271	langchain-core@0.3.29	1.2.11

Open the chart page →

5,062

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	langchain-core@0.3.54	1.2.11

Open the chart page →

8,405

chatbot-ai-sampleopenshift

1 of 4 See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	langchain-core@0.1.52	1.2.11

Open the chart page →

18,922

1 of 1 See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	langchain-core@0.3.43	1.2.11

Open the chart page →

3,512

noderss3

1 of 3 See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	langchain-core@0.3.43	1.2.11

Open the chart page →

4,718

chatqnatest-opea

2 of 11 See more

chatqna test-opea 1.0.0

2 of the 11 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/embedding-tei :1.0	5c9639de61c1	langchain-core@0.3.1	1.2.11
opea/retriever-redis :1.0	eb746b263705	langchain-core@0.3.1	1.2.11

Open the chart page →

39,090

docsumtest-opea

1 of 5 See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	langchain-core@0.3.1	1.2.11

Open the chart page →

28,858

embedding-usvctest-opea

1 of 1 See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/embedding-tei :1.0	5c9639de61c1	langchain-core@0.3.1	1.2.11

Open the chart page →

5,185

guardrails-usvctest-opea

1 of 1 See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/guardrails-tgi :1.0	262c6048aab8	langchain-core@0.3.1	1.2.11

Open the chart page →

5,221

retriever-usvctest-opea

1 of 1 See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/retriever-redis :1.0	eb746b263705	langchain-core@0.3.1	1.2.11

Open the chart page →

5,198

web-retrievertest-opea

1 of 1 See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-26013.

Container image	Digest	Package	Fixed in
opea/web-retriever-chroma :1.0	fe08165d7770	langchain-core@0.3.1	1.2.11

Open the chart page →

5,350

Container images carrying it

17 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
opea/embedding-tei :1.0	5c9639de61c1	langchain-core@0.3.1	1.2.11	2
opea/retriever-redis :1.0	eb746b263705	langchain-core@0.3.1	1.2.11	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	langchain-core@0.3.43	1.2.11	2
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	langchain-core@0.3.54	1.2.11	1
baserow/backend :1.31.1	e0b3c8130b91	langchain-core@0.1.52	1.2.11	1
baserow/baserow :1.30.1	df0c42eb67e8	langchain-core@0.1.52	1.2.11	1
ilum/streamlit-example :1.0.0	ce5dcdeb22ba	langchain-core@1.1.0	1.2.11	1
opea/guardrails-tgi :1.0	262c6048aab8	langchain-core@0.3.1	1.2.11	1
opea/guardrails-tgi :latest	f68bec6a1271	langchain-core@0.3.29	1.2.11	1
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	langchain-core@0.3.1	1.2.11	1
opea/web-retriever-chroma :1.0	fe08165d7770	langchain-core@0.3.1	1.2.11	1
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	langchain-core@0.3.72	1.2.11	1
sruthitanneru/pi-sample :ui-latest	e565ea454ffd	langchain-core@0.3.21	1.2.11	1
tock/gen-ai-orchestrator-server :25.10.7	abf7880e0449	langchain-core@0.3.83	1.2.11	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	langchain-core@0.1.23	1.2.11	1
ghcr.io/hemslo/chat-search :latest	39d48995a5bd	langchain-core@0.2.22	1.2.11	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	langchain-core@0.1.52	1.2.11	1