CVE-2026-118667 in langgraph
Summary
by MITRE • 10/28/2026
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The LangGraph Python SDK serves as a critical interface for connecting to running LangGraph API servers, enabling developers to manage assistants, threads, and stream runs directly from Python applications. Within specific versions of this ecosystem, specifically langgraph-sdk ranging from 0.4.0 to 0.4.6 and langgraph from 1.2.3 to 1.2.14 when utilizing RemoteGraph v3 streaming, a significant security flaw exists in the handling of request path parameters. The vulnerability resides within the synchronous and asynchronous helper functions get_tree and _fetch_state, which are responsible for retrieving graph structures and fetching state information respectively. These functions interact with authenticated endpoints on remote servers to retrieve data relevant to specific assistant instances or conversation threads identified by their unique identifiers.
The core technical flaw is a path traversal issue caused by improper input validation and sanitization of user-supplied values. When constructing HTTP GET requests, the SDK interpolates caller-controlled variables such as assistant_id and thread_id directly into the URL path segments without employing proper quoting mechanisms like _quote_path_param. This lack of encoding allows relative path segments to be injected or interpreted incorrectly by the server's routing logic. Instead of treating these identifiers strictly as opaque string values representing specific resource IDs, the application fails to normalize them safely against directory traversal sequences such as dot-dot-slash patterns. Consequently, an attacker who can influence these parameters may manipulate the request URL structure during normalization on the configured server side.
This vulnerability leads to a severe authentication bypass scenario classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command or CWE-200 Exposure of Sensitive Information depending on the specific exploitation vector, though it most closely aligns with CWE-611 Improper Restriction of XML External Entity Reference concepts applied to URL paths and generally falls under CWE-434 Unrestricted Upload of File with Dangerous Type if file access is involved, but primarily represents a Broken Access Control issue where path manipulation allows access to unintended resources. More accurately, this is an instance of CWE-209 Generation of Error Message Containing Sensitive Information or CWE-77 Command Injection via Path Traversal depending on server implementation, but the most precise classification in modern frameworks is often associated with CWE-436 if it leads to arbitrary file read or simply a path traversal vulnerability that bypasses intended access controls. The attacker can potentially traverse up directory levels or redirect requests to different endpoints within the same authentication scope. Because the HTTP headers containing valid authentication tokens are retained during this manipulation, the server processes these unauthorized paths as legitimate authenticated requests for resources outside the intended context of the original assistant or thread ID.
The operational impact of this vulnerability is substantial, allowing an adversary with knowledge of the API structure to access sensitive data associated with other assistants or threads that they should not have permission to view. By manipulating the path segments, an attacker could potentially retrieve state information from unrelated conversations or graph configurations, leading to a breach of confidentiality and integrity within the LangGraph application environment. This undermines the isolation guarantees provided by the assistant and thread architecture, as the security boundary defined by these identifiers is effectively neutralized through path manipulation techniques that exploit the server's URL parsing behavior rather than breaking cryptographic protections.
To mitigate this risk, organizations must immediately upgrade to langgraph-sdk version 0.4.6 or later and langgraph version 1.2.14 or later, where the issue has been resolved by implementing proper parameter quoting and path normalization safeguards. Developers should also ensure that their CI/CD pipelines enforce these minimum versions for all dependencies related to LangGraph interactions. In environments where immediate patching is not feasible, applying a web application firewall rule to detect and block common path traversal sequences in API requests targeting langgraph endpoints can provide temporary protection. Furthermore, auditing codebases for any custom implementations of similar helper functions that interpolate user input into URL paths without proper encoding is recommended to prevent analogous vulnerabilities from being introduced through manual coding practices.