CVE-2026-104873 in LangGraph
Summary
by MITRE • 10/02/2026
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on the resource. Because that wildcard resource handler is selected before broader fallback handlers, an authenticated user may bypass fallback action, ownership, or permission checks and read, update, or delete another user's resource. Only Python deployments using actions on the affected decorators are vulnerable, and a deployment remains protected when the selected handler independently enforces all required checks for every action it receives. This issue is fixed in version 0.4.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The LangGraph Python SDK serves as a critical interface for connecting to running LangGraph API servers, enabling developers to manage assistants, threads, and stream runs directly from Python applications. Within the ecosystem of this software development kit, authorization decorators such as auth.on.threads, auth.on.assistants, and @auth.on.crons are designed to enforce resource-scoped access controls by associating specific handler functions with particular actions on designated resources. These mechanisms are fundamental to maintaining data integrity and ensuring that users can only interact with assets they own or have been explicitly permitted to access. The security architecture relies heavily on the correct interpretation of action parameters within these decorators to establish precise boundaries for user permissions.
A critical vulnerability exists in versions 0.1.45 through 0.4.4 of the LangGraph SDK, where a logic flaw causes the resource-scoped authorization decorators to ignore the actions argument entirely. Instead of registering handlers only for specified actions, the system incorrectly registers the selected handler for every possible action on the targeted resource type. This behavior effectively creates a wildcard permission set that overrides intended restrictions. Because these specific handlers are registered with higher priority than broader fallback handlers in the routing logic, they intercept requests before general security checks can be applied. Consequently, an authenticated user who utilizes any of the affected decorators gains unauthorized access to all actions on those resources, regardless of whether their account should have limited privileges or no access at all.
The operational impact of this flaw is severe, as it allows for a complete bypass of fallback action, ownership, and permission checks. An attacker with valid authentication credentials can exploit this misconfiguration to read sensitive data from another user's threads, update configurations belonging to other assistants, or delete critical resources owned by different users. This represents a classic case of broken access control where the principle of least privilege is violated due to overly permissive default behaviors in authorization middleware. The vulnerability aligns with CWE-284 Improper Access Control and maps directly to MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to escalate privileges or perform unauthorized actions within the application environment.
It is important to note that this vulnerability only affects Python deployments where developers explicitly use action-based logic on the affected decorators. Deployments that do not rely on these specific authorization patterns remain unaffected by this flaw. Furthermore, a deployment can be considered protected if the selected handler independently enforces all required checks for every action it receives, effectively mitigating the risk through custom validation logic within the application code rather than relying solely on the decorator's internal routing behavior. This highlights that while the library contains the defect, the actual exploitation depends on how developers implement their authorization layers around these components.
To mitigate this vulnerability and restore secure operation, organizations must upgrade to version 0.4.4 or later of the LangGraph SDK, where the logic error has been corrected to properly respect the actions argument in resource-scoped decorators. For environments that cannot immediately update due to dependency constraints, a temporary mitigation involves ensuring that any handler registered via these decorators performs its own rigorous validation of user permissions and ownership for every action it processes. This defensive programming approach ensures that even if the decorator grants broad access, the application logic will reject unauthorized requests before they result in data exposure or modification. Regular auditing of authorization implementations and keeping third-party dependencies up to date are essential practices for maintaining a robust security posture against such implementation flaws.