Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118667LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

Medium 4.3

In plain English

A medium-severity path traversal in langgraph from langchain-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 66.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlanggraph1.2.14GHSA-3fx2-cqw9-xr3c
PyPIlanggraph-sdk0.4.6GHSA-3fx2-cqw9-xr3c

Affected products (as reported)

VendorProductVersions
langchain-ai langgraph >= 1.2.3, < 1.2.14
langchain-ai langgraph-sdk >= 0.4.0, < 0.4.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References