GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read

Two defects combine. A field in a tracing-propagation header was merged into the run without validation, so a caller could inject run attributes, including attachments. A type check meant to guard filesystem access did not match the type of the decoded input, so the guard never ran. The server then opened the file the attacker named, and the background tracing thread uploaded it as a trace attachment.

Anyone who can send an HTTP request to the server can trigger the read. Depending on how distributed tracing is deployed, no authentication may be needed. The upload uses the server's own LangSmith API key and workspace, and the attacker cannot redirect it. So someone with no workspace access cannot get the content back.

The real exposure is a trust boundary. A low-privilege workspace member, a contractor or a compromised teammate account, any of whom can read traces, can have the attacker's request pull files from any server that runs TracingMiddleware. That could be environment files, API keys or cloud credentials on the application host. The advisory rates confidentiality impact high and the others none.

pip package langsmith before 0.8.18, in services that add TracingMiddleware to an HTTP app, such as a FastAPI or Starlette service that takes distributed trace headers. Check the installed version:

pip show langsmith

Search your code for TracingMiddleware. Services that use the SDK for tracing without that middleware are not described as affected.

Upgrade the Python SDK to 0.8.18 or later.

pip install --upgrade "langsmith>=0.8.18"

The advisory gives these workarounds until you upgrade: do not expose TracingMiddleware to untrusted HTTP traffic, and limit trace-read access in your LangSmith workspace to trusted members. After patching, consider whether sensitive files were uploaded as attachments, and rotate secrets if so.

Look in LangSmith traces from services that use TracingMiddleware for attachments you did not expect, especially ones with contents like environment files, key files or /etc files. Check HTTP access logs for requests to those services that carry unusual tracing-propagation headers from unknown clients. Review who in the workspace has trace-read access and what they opened.

Summary

An attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary.

Impact

Confidentiality (High): arbitrary read of files accessible to the server process, exposed to anyone with workspace trace-read access.

Details

Two defects combine. A field supplied through a tracing-propagation header was merged into the run without validation, allowing injection of run attributes including attachments (CWE-346). A type check intended to gate filesystem access did not match the type of the decoded input, so the guard never engaged (CWE-843). As a result, an attacker-named file is opened by the server and uploaded as a trace attachment by the background tracing thread (CWE-22).

Who can exploit this

• Anyone reachable by HTTP can trigger the file read. Depending on how the distributed trace system is deployed, triggering may not require authentication.
• Retrieving the file contents requires read access to the destination LangSmith workspace. The upload uses the server's own configured API key and workspace, which the attacker cannot redirect, so a zero-access outsider cannot retrieve the result; a workspace member, or anyone who has compromised one, can.

Remediation

Upgrade the Python SDK to >= 0.8.18.

Workarounds

Until upgrading, do not expose TracingMiddleware to untrusted HTTP traffic, and limit workspace trace-read access to trusted members.

Credits

First reported by @Ryu7zz.