LangGraph CLI prints registry push token in verbose deploy output
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
The langgraph and langgraph-cli (PyPI) packages from 0.4.15 before 0.4.32 are affected. When langgraph deploy --verbose runs, the CLI subprocess helper prints a temporary registry push token passed to docker login, which exposes sensitive information in logs (CWE-532). Anyone who can read CI logs or terminal recordings before the token expires (maximum 12 hours) can pull deployment images or push images to that deployment's image repository.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| langchain-ai | langgraph | 0.4.15 to before 0.4.32 | 0.4.32 | Patch available | CNA |
| — | langgraph-cli (PyPI) | 0.4.15 to before 0.4.32 | 0.4.32 | Patch available | GHSA-8prr-f582-jqq3 |
- langgraph Vendorlangchain-ai Affected 0.4.15 to before 0.4.32 Fixed in 0.4.32 Patch available CNA
- langgraph-cli (PyPI) Vendor— Affected 0.4.15 to before 0.4.32 Fixed in 0.4.32 Patch available GHSA-8prr-f582-jqq3
Remediation
Upgrade langgraph and langgraph-cli to version 0.4.32, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA langgraph (langchain-ai) Fixed in 0.4.32
- Fix · GHSA-8prr-f582-jqq3 langgraph-cli (PyPI) Fixed in 0.4.32 Advisory →
Vendor assessments
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115885
- 2026-10-28 Alias added: GHSA-8prr-f582-jqq3
- 2026-10-28 Fix available: PyPI/[email protected] · GHSA-8prr-f582-jqq3
- 2026-10-28 CVSS score added · GHSA-8prr-f582-jqq3
- 2026-10-28 Weakness changed · GHSA-8prr-f582-jqq3
- 2026-10-28 6 new references · GHSA-8prr-f582-jqq3
- 2026-10-29 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-8prr-f582-jqq3
- https://github.com/langchain-ai/langgraph/pull/8482
- https://github.com/langchain-ai/langgraph/commit/1afaca35a0d4962fb0203a0e9133a07ffd6a553c
- https://github.com/langchain-ai/langgraph/releases/tag/cli%3D%3D0.4.32.dev0
- https://github.com/langchain-ai/langgraph
More langchain-ai vulnerabilities
- TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
- TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
- TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
- TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-115885 · CVE Program
- CVE-2026-115885 · NVD
- FIRST EPSS
- GHSA-8prr-f582-jqq3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115885 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences