CVE-2026-115885 in LangGraph
Summary
by MITRE • 10/24/2026
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The LangGraph CLI serves as the primary command-line interface for managing LangGraph deployments, facilitating interactions with cloud infrastructure and container registries. A critical security vulnerability was identified within versions ranging from 0.4.15 to 0.4.32, specifically affecting the execution of deployment commands when the verbose flag is enabled. This flaw stems from an improper handling of sensitive credentials during the authentication process for Docker registry operations. When a user executes a command such as langgraph deploy with the --verbose option, the CLI attempts to authenticate with a container image registry by passing a temporary push token via standard input to docker login using the password-stdin argument. While this method is generally secure in isolation, the implementation of the verbose logging mechanism introduces a significant exposure vector by inadvertently capturing and printing the contents of standard input to the console output or log files for debugging purposes.
The technical flaw lies in the subprocess helper function used by the CLI, which was configured to echo command inputs when verbosity is enabled. Consequently, the temporary registry push token, intended solely for secure transmission to the Docker daemon, is written directly into the terminal stdout stream and subsequently captured by any logging infrastructure or session recording tools that monitor the execution environment. This behavior transforms a transient authentication credential into persistent plaintext data within system logs. The vulnerability specifically impacts environments where CI/CD pipelines, local development terminals, or monitoring agents record standard output streams without filtering sensitive input parameters. It does not affect deployments executed without the verbose flag nor remote image builds that do not utilize this specific interactive login flow, indicating a narrow but high-impact scope of exposure limited to debug-enabled sessions.
The operational impact of this vulnerability is severe due to the nature of the exposed credential. The leaked token grants write access to the deployment's associated container image repository for up to twelve hours before expiration. An attacker with read access to these logs or recordings can extract the token and use it to pull sensitive application images, potentially exposing proprietary codebases, configuration secrets embedded in environment variables, or internal service architectures. More critically, the token allows pushing new images to the registry associated with that deployment. Although the vulnerability description notes that possessing the token alone does not automatically update a running deployment to execute a pushed image, it enables an attacker to poison the artifact repository. This could lead to supply chain attacks where malicious code is introduced into the build pipeline for future deployments or used to exfiltrate intellectual property by pulling existing images containing sensitive data. The risk is amplified in continuous integration environments where logs are often stored centrally and accessible to a wide range of developers and automated systems, increasing the likelihood of credential compromise over time.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary resolution involves upgrading the LangGraph CLI to version 0.4.32 or later, where this logging behavior has been corrected to prevent sensitive input from being echoed during verbose operations. For organizations unable to upgrade immediately, manual mitigation requires disabling verbose logging in production CI/CD pipelines and ensuring that any custom scripts wrapping the CLI do not capture standard input streams containing authentication data. Additionally, security teams should audit existing log archives for potential exposure of tokens generated between version 0.4.15 and 0.4.32, revoking any compromised credentials immediately upon detection. To prevent recurrence, development practices should enforce strict separation of sensitive inputs from logging outputs, utilizing secure credential injection methods such as environment variables or secret managers rather than standard input for authentication flows where possible. This incident aligns with CWE-537, which describes the inclusion of internal information into an error message that could be exploited by attackers, and maps to MITRE ATT&CK techniques related to Credential Access via Log Files, highlighting the importance of sanitizing logs against sensitive data leakage in automated environments.