CVE-2025-2828 is a critical (CVSS 10.0) server-side request forgery in the RequestsToolkit component of langchain-community. The toolkit does not stop requests to local addresses, so an agent can be steered to internal services and cloud metadata. The record says the fix is in 0.0.28, so upgrade.
What's affected
The record says the flaw is in langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit, in langchain-ai/langchain version 0.0.27, and has been fixed in version 0.0.28. The product field in the record is listed as langchain.
Version numbers for the langchain family have changed a great deal since then, because the project split into several packages. Treat the record's numbers with care: check the fix commit linked in Sources and the huntr report, and confirm that the langchain-community you run includes the change. A current release is a safer target than the exact number.
Severity in the record: critical, CVSS 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Weakness classes: CWE-918 (Server-side request forgery).
How to check if you're exposed
Find the installed versions:
pip show langchain langchain-community
pip list | grep -i langchain
Search your code for the toolkit:
grep -rn "RequestsToolkit" .
If it appears, the agent can make HTTP requests chosen by a model. Check which hosts it can reach, and from where the code runs. The free in-browser dependency scan at gold.safeguard.sh/scan reads requirements.txt or poetry.lock and lists this CVE for the packages you have. The demo below shows how a package inventory helps track which projects use it.
What to do now
- Upgrade
langchain-communityto a current release that includes the fix, and rebuild lock files. - Search every service, notebook and agent project for
RequestsToolkitand for other tools that fetch URLs. - Add an allow list of hosts for any tool that makes outbound requests, and block loopback, link-local and private address ranges in the code and at the network.
- On cloud hosts, require the hardened version of the instance metadata service and give the workload the smallest role possible.
- Run agents in a network segment with no route to internal admin services.
- Log every URL an agent requests and alert on private or metadata addresses.
Why it matters
Server-side request forgery (CWE-918) turns a server into a proxy for the attacker. The application makes a request to an address that the attacker influences, and because the request comes from inside the network it can reach things the attacker cannot. The record lists port scans, local services, cloud instance metadata and servers on the local network as examples.
The score is the maximum, 10.0, because the vector is a network attack with no login and no interaction, with a changed scope and high impact on all three properties. With AI agents the risk has a twist: the address can be chosen by a language model working from text it was given, so prompt content from a web page or a document can act as the attacker. Network level limits therefore matter more than hoping the model refuses.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Try it yourself
This demo shows a dependency inventory across projects, which is the quickest way to find every place a package like langchain-community is used.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-2828?
The record says 0.0.28. Because the langchain packages have been reorganised since, confirm with the fix commit and use a current release.
Is my agent exposed if it never uses RequestsToolkit?
The record names that toolkit. If you do not use it, this CVE does not apply, but any tool that fetches URLs needs the same host restrictions.
Sources
Last reviewed: 19 October 2026.
