What Happened
Cyera disclosed a path traversal vulnerability in LangChain, tracked as CVE-2026-34070, with a CVSS score of 7.5. This flaw lets attackers access files outside intended directories by manipulating file paths. This follows an earlier unsafe deserialization vulnerability in the same framework, which had a critical 9.3 CVSS rating.
These vulnerabilities highlight a recurring issue: AI orchestration frameworks are neglecting basic input validation. LangChain and LangGraph, designed to connect large language model calls with external data, are introducing the same flaws we've battled in web applications for years.
Timeline
The discovery date for CVE-2026-34070 isn't public, but Cyera's disclosure came after analyzing LangChain's file handling. The earlier deserialization flaw suggests multiple security reviews identified separate input validation failures in the codebase.
For your team: if you deployed LangChain before these fixes, you're running code that treats user-supplied file paths as trusted input.
Which Controls Failed or Were Missing
Input Validation at the Framework Level. LangChain accepted file paths from users without enforcing directory boundaries, failing to validate that requested paths stayed within allowed locations.
Allowlist Enforcement. LangChain didn't implement allowlists for accessible files or directories. Any path resolving to a readable file could be accessed, regardless of its intended availability.
Deserialization Safeguards. The earlier flaw shows LangChain deserialized data without validating object types or enforcing safe construction patterns, a mistake common in Java applications since the early 2000s.
Dependency Security Review. Organizations deploying LangChain didn't treat it as untrusted code requiring input validation scrutiny, mistakenly assuming "it's for AI" meant traditional security controls didn't apply.
What the Relevant Standard Requires
OWASP ASVS v4.0.3, Requirement 5.1.3: Applications must validate all input from untrusted sources. File paths are input, and the standard calls out path traversal as a validation failure.
OWASP Top 10 2021, A03:2021, Injection: Path traversal is an injection attack. The framework failed to sanitize file path input before using it in file system operations.
PCI DSS v4.0.1, Requirement 6.2.4: If processing payment data, you must address known vulnerabilities. A 7.5 CVSS score qualifies, regardless of whether the code is "traditional" or "AI-powered."
NIST 800-53 Rev 5, SI-10 (Information Input Validation): Federal systems must check the validity of information inputs, including syntax and semantics. A valid path syntax doesn't mean the path should be accessible.
Cyera's recommendation to enforce allowlists and restrict directory boundaries isn't new. It's what OWASP ASVS has required since version 1.0. The problem is development teams building AI features didn't apply the same controls they'd use for a file upload endpoint.
Lessons and Action Items for Your Team
Audit Your AI Framework Dependencies. Run pip list or equivalent to identify every AI/ML library in your stack. Treat LangChain, LangGraph, and similar tools as you would any web framework. They accept external input, make decisions based on that input, and interact with your infrastructure.
Implement Allowlists for File Access. If your AI pipeline reads files, define exactly which directories and file types it's allowed to access. Reject any path that resolves outside those boundaries. This is Cyera's primary mitigation recommendation.
# Don't do this
file_path = user_input
with open(file_path) as f:
content = f.read()
# Do this
from pathlib import Path
ALLOWED_DIR = Path("/var/app/data")
requested_path = Path(user_input).resolve()
if not requested_path.is_relative_to(ALLOWED_DIR):
raise ValueError("Path outside allowed directory")
with open(requested_path) as f:
content = f.read()
Review Deserialization Patterns. If you're using pickle, yaml.load(), or similar deserialization in your AI pipelines, you're carrying the unsafe deserialization risk that scored 9.3 in LangChain. Switch to safe alternatives: json.loads() for data, yaml.safe_load() for configs.
Map AI Components to OWASP ASVS Controls. Take your AI pipeline diagram and annotate each component with the ASVS requirements it must satisfy. Does this component accept user input? Apply Chapter 5 (Validation). Does it make authentication decisions? Apply Chapter 2 (Authentication).
Update Your Threat Model. Path traversal in an AI framework can expose training data, prompt templates, API keys stored in config files, or customer data used for retrieval-augmented generation. Your threat model should explicitly cover "attacker manipulates AI framework to access sensitive files."
Don't Wait for CVEs. These vulnerabilities existed in production LangChain deployments before CVE-2026-34070 was assigned. Your security testing should catch path traversal and unsafe deserialization regardless of whether the vendor has disclosed them. Run DAST tools against your AI endpoints. Fuzz file path parameters. Test deserialization with malicious payloads.
The pattern is clear: AI frameworks are repeating security mistakes solved in web applications years ago. Ensure your team doesn't make the same mistake by assuming AI code doesn't need traditional security controls.
