LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.2.14, 0.4.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The LangGraph Python SDK (langgraph-sdk) and the langgraph library's RemoteGraph streaming feature are affected. The flaw could let a crafted assistant or thread identifier redirect an authenticated read request to a different readable endpoint on the same configured server, potentially exposing data the caller should not access.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- langchain-ai langgraph
From 1.2.3 · fixed in 1.2.14
- langchain-ai langgraph-sdk
From 0.4.0 · fixed in 0.4.6
- langgraph-sdkPyPI
From 0.4.0 · fixed in 0.4.6
- langgraphPyPI
From 1.2.3 · fixed in 1.2.14