Medium [CVE-2026-59152] Information Disclosure via Arbitrary Server-Side File Read
This medium-severity Red Hat Linux advisory covers CVE-2026-59152 affecting Exploit Intelligence, Migration Toolkit for Applications 8, OpenShift Lightspeed.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running the LangSmith SDK's TracingMiddleware can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment.
Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to.
The net effect is a trust-boundary crossing: a party with workspace trace-read access (for example a low-privilege workspace member, a contractor, or a compromised teammate account) gains the ability to read files from any server running TracingMiddleware, a capability outside that workspace's intended trust boundary. This vulnerability is fixed in 0.8.18.
This Moderate-impact information disclosure flaw in LangSmith Client SDK's TracingMiddleware allows an authenticated attacker with trace-read access to a LangSmith workspace to read arbitrary files from a server running the middleware.
This represents a trust-boundary crossing, enabling unauthorized access to local filesystem data on affected systems where the TracingMiddleware is exposed via HTTP. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
- < 0.8.18
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation
Upgrade to a fixed release: 0.8.18. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.