CVE-2026-25528 affected applications that passed untrusted HTTP tracing headers into the LangSmith SDK. A crafted baggage header could add an attacker-controlled replica URL; when a traced operation finished, the SDK sent run data to that destination. Inputs, outputs, and application metadata could therefore leave through a feature intended for observability. The flaw shows that tracing context is active routing authority, not harmless metadata.
TracingMiddleware accepted public request headers, or code passed them to RunTree.from_headers() or RunTree.fromHeaders(). Using LangSmith without that path was not enough.baggage header carried destination authority. An attacker could add a replica object containing an api_url. Vulnerable SDK versions stored it as tracing configuration, then post() and patch() sent run data to the injected URL after the traced work completed. The same control could target an internal URL as SSRF.baggage with a strict schema and a safe-field allowlist, reject unknown replica fields, and remove caller-controlled api_url, api_key, or equivalent authority before tracing context is created. This is structured-header validation, not a prompt-injection filter.TracingMiddleware, RunTree.from_headers(), and RunTree.fromHeaders(). Strip untrusted baggage fields before those calls, or avoid propagating public request headers into tracing context.The defect crossed two boundaries that observability code often blurs: request context decided where data would go, and rich AI run data left the service as routine telemetry. AIDEFEND maps this case to four separate controls: deploy the fixed SDK, remove routing authority from untrusted headers, minimize trace contents before export, and enforce destination policy outside the process. Tracing metadata should describe a request, never grant it a new network route.