Read the docs
TI-2026-82212 Aliases CVE-2026-118668GHSA-4hm6-w6qq-w73v

Cross-user Store access in LangGraph JavaScript custom authentication

Priority LOW 39CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

The langchain-ai langgraph-api package from 0.1.2 before 0.15.0 has a flaw in JavaScript and TypeScript custom authentication Store handlers. A namespace rewritten by the authorization handler is not carried across the runtime boundary, so it is not applied before the Store operation (CWE-639). An authenticated user can read, overwrite, search, or delete another user's Store namespace when a deployment relies on namespace rewriting for isolation. Python custom authentication and handlers that reject unauthorized namespaces are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user's Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed langgraph-api (langchain-ai): 0.15.0langgraph-api (PyPI): 0.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
langchain-ailanggraph-api0.1.2 to before 0.15.00.15.0Patch availableCNA
—langgraph-api (PyPI)0.1.2 to before 0.15.00.15.0Patch availableGHSA-4hm6-w6qq-w73v
  • langgraph-api Vendorlangchain-ai Affected 0.1.2 to before 0.15.0 Fixed in 0.15.0 Patch available CNA
  • langgraph-api (PyPI) Vendor— Affected 0.1.2 to before 0.15.0 Fixed in 0.15.0 Patch available GHSA-4hm6-w6qq-w73v

Remediation

Upgrade langgraph-api to version 0.15.0 for both the langchain-ai langgraph-api product and the PyPI langgraph-api package.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA langgraph-api (langchain-ai) Fixed in 0.15.0
  • Fix · GHSA-4hm6-w6qq-w73v langgraph-api (PyPI) Fixed in 0.15.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118668
  2. 2026-10-28 Alias added: GHSA-4hm6-w6qq-w73v
  3. 2026-10-28 Fix available: PyPI/[email protected] · GHSA-4hm6-w6qq-w73v
  4. 2026-10-28 CVSS score added · GHSA-4hm6-w6qq-w73v
  5. 2026-10-28 Weakness changed · GHSA-4hm6-w6qq-w73v
  6. 2026-10-28 2 new references · GHSA-4hm6-w6qq-w73v
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW
  9. 2026-11-06 Affected versions changed · Red Hat
  10. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
  • TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
  • TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences