SSRF via Improper Domain Validation in LangChain SitemapLoader

CVE-2026-72848 identifies a critical server-side request forgery (SSRF) vulnerability within the langchain_community library, specifically in the SitemapLoader class. The vulnerability arises from an incomplete implementation of the restrict_to_same_domain security control. While the loader correctly enforces domain restrictions on leaf URL entries, it fails to apply these same checks to nested sitemap elements.

When processing sitemaps, the loader recursively handles nested sitemap entries by passing them directly to WebBaseLoader.scrape_all and subsequently an aiohttp GET request. This process occurs without any validation against internal, loopback, or link-local address spaces. An attacker who can influence the sitemap input provided to the application can force the server to fetch internal resources. Because the application then parses and returns the content of these internal requests to the caller, this flaw results in the unauthorized disclosure of sensitive internal data. This vulnerability affects users deploying LangChain components in environments where they rely on restrict_to_same_domain for network isolation.

Impact

Successful exploitation allows for the unauthorized retrieval of internal service data that is otherwise unreachable from the public internet. This includes internal configuration files, metadata services, and internal APIs that are protected by network perimeter defenses but vulnerable to requests originating from within the server environment. This vulnerability poses a high risk to cloud-based deployments and containerized environments where the LangChain application may have implicit access to local network segments or internal cloud metadata endpoints (e.g., 169.254.169.254).

Recommendation

• Monitor egress traffic from application servers hosting LangChain components to detect unusual HTTP requests to internal IP ranges (RFC1918) or local infrastructure services.
• Implement network-level egress filtering (e.g., via Kubernetes NetworkPolicies or Cloud Security Groups) to restrict the langchain_community application's ability to communicate with internal network segments that do not require access.
• Audit applications utilizing SitemapLoader to determine if input sitemaps are sourced from untrusted or user-controlled locations.
• Update langchain_community to a patched version once released by the vendor to address the logic flaw in parse_sitemap.