langchain-ai langgraph up to 1.2.4 Task Result Cache _cache.py _freeze default_cache_key weak hash

Summaryinfo

A vulnerability categorized as problematic has been discovered in langchain-ai langgraph up to 1.2.4. The impacted element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. Such manipulation of the argument default_cache_key leads to weak hash. This vulnerability is listed as CVE-2026-14742. The attack may be performed from remote. In addition, an exploit is available. The pull request to fix this issue awaits acceptance.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in langchain-ai langgraph up to 1.2.4. Affected by this issue is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. The manipulation of the argument default_cache_key with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is confidentiality.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-14742. The exploitation is known to be difficult. The attack may be launched remotely. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1600.001.

The exploit is available at github.com. It is declared as proof-of-concept. The pull request to fix this issue awaits acceptance.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• langchain-ai

Name

• langgraph

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4

Website

• Product: https://github.com/langchain-ai/langgraph/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #849217: langchain-ai langgraph 1.2.4 Use of Weak Hash (by Dem0)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion