CVE-2026-118668: LangGraph servers with JavaScript custom auth can let one user read and overwrite another user's Store data, plus SDK path and CLI token fixes

What it is

CVE-2026-118668 (GHSA-4hm6-w6qq-w73v, high, langgraph-api 0.1.2 to before 0.15.0): when a JavaScript or TypeScript Store authorization handler restricts users by rewriting the requested namespace, the rewrite was not carried across the runtime boundary, so the original namespace was used. Python handlers, and JS/TS handlers that reject unauthorized namespaces instead of rewriting them, are not affected.

CVE-2026-118667 (GHSA-3fx2-cqw9-xr3c, moderate, langgraph-sdk 0.4.0 to 0.4.5, and langgraph 1.2.3 to before 1.2.14 for RemoteGraph): the v3 streaming client put thread_id and assistant_id into request paths without encoding them, so attacker-controlled IDs with relative segments could redirect an authenticated GET to another path on the same server, such as a Store item. It only matters if your app passes untrusted text as those IDs; LangGraph Platform itself is not exposed.

CVE-2026-115885 (GHSA-8prr-f582-jqq3, moderate, langgraph-cli 0.4.15 to 0.4.31): langgraph deploy --verbose printed the temporary registry push token used for docker login. Anyone who could read that output, for example in CI logs, could pull and push images for that deployment's repository for up to 12 hours.

How to check

1. Affected: langgraph-api before 0.15.0 with JS/TS custom auth that rewrites Store namespaces; langgraph-sdk 0.4.0 to 0.4.5; langgraph 1.2.3 to 1.2.13 (RemoteGraph v3 streaming); langgraph-cli 0.4.15 to 0.4.31.
2. Look through CI logs for langgraph deploy --verbose runs with an affected CLI; those tokens have expired after 12 hours but the logs may still be shared.

How to fix

1. Upgrade langgraph-api to 0.15.0 or later. If you can't yet, change every JS/TS Store authorization handler to reject unauthorized namespaces instead of rewriting them.
2. Upgrade langgraph-sdk to 0.4.6 or later, and langgraph to 1.2.14 or later if you use RemoteGraph.
3. Upgrade langgraph-cli to 0.4.32 or later (0.4.37 also stops --verbose from printing any command input).

pip show langgraph-api langgraph-sdk langgraph langgraph-cli | grep -E 'Name|Version'
pip install -U 'langgraph-api>=0.15.0' 'langgraph-sdk>=0.4.6' 'langgraph>=1.2.14' 'langgraph-cli>=0.4.32'

Sources

• LangGraph advisory GHSA-4hm6-w6qq-w73v (JS custom auth Store access) ↗
• LangGraph advisory GHSA-3fx2-cqw9-xr3c (SDK v3 streaming identifiers) ↗
• LangGraph advisory GHSA-8prr-f582-jqq3 (CLI push token in verbose output) ↗