BREW-LANGGRAPH-CLI-CVE-2… (GHSA-FVWW-7H3R-VFHP)
Vulnerability from osv_homebrew – Published: 2026-10-06 09:23 – Updated: 2026-10-06 09:23 – Source websiteImpact
What kind of vulnerability is it? Who is impacted?
langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons.
In affected versions, a decorator such as:
@auth.on.threads(actions=["create"])
async def allow_thread_create(ctx, value):
return None
intended to register a handler for selected actions instead registers that handler for every action on the resource. Because the resource-wide handler is selected before broader fallback handlers, authorization checks implemented in those fallback handlers may not run.
An authenticated user may therefore be able to perform actions the application intended to deny, such as reading, updating, or deleting another user's resource. Exploitability and impact depend on the affected handler's behavior: deployments remain protected if that handler independently enforces the necessary action, ownership, or permission checks for every request it receives.
Only Python deployments using actions= on the affected resource-scoped decorators are affected.
Patches
0.4.4
Workarounds
No.
References
N/A
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "langgraph-sdk",
"resource_purl": "pkg:pypi/langgraph-sdk@0.4.5",
"upstream_fixed_in": "0.4.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "langgraph-cli",
"purl": "pkg:brew/langgraph-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.11"
},
{
"fixed": "0.4.31_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/langgraph-sdk@0.4.5",
"name": "langgraph-sdk",
"resource": "langgraph-sdk",
"strategy": "registry",
"subject_version": "0.4.5"
}
]
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n`langgraph-sdk` incorrectly applies the `actions=` argument on resource-scoped authorization decorators, including `@auth.on.threads`, `@auth.on.assistants`, and `@auth.on.crons`.\n\nIn affected versions, a decorator such as:\n\n```python\n@auth.on.threads(actions=[\"create\"])\nasync def allow_thread_create(ctx, value):\n return None\n```\nintended to register a handler for selected actions instead registers that handler for every action on the resource. Because the resource-wide handler is selected before broader fallback handlers, authorization checks implemented in those fallback handlers may not run.\n\nAn authenticated user may therefore be able to perform actions the application intended to deny, such as reading, updating, or deleting another user\u0027s resource. Exploitability and impact depend on the affected handler\u0027s behavior: deployments remain protected if that handler independently enforces the necessary action, ownership, or permission checks for every request it receives.\n\nOnly Python deployments using `actions=` on the affected resource-scoped decorators are affected.\n\n### Patches\n\n0.4.4\n\n### Workarounds\n\nNo.\n\n### References\n\nN/A",
"id": "BREW-langgraph-cli-CVE-2026-104873",
"modified": "2026-10-06T09:23:18Z",
"published": "2026-10-06T09:23:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-fvww-7h3r-vfhp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104873"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langgraph/commit/5a77be5e8bec1600ad0a865638d88c1368497559"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langgraph"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langgraph/releases/tag/sdk==0.4.4"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "LangGraph SDK custom auth silently ignores actions= on resource decorators",
"upstream": [
"GHSA-fvww-7h3r-vfhp",
"CVE-2026-104873"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.