Vulnerability-Lookup

PYSEC-2026-3858

Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02

Details

Summary

In affected versions of langgraph-api (the LangGraph Server runtime), the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the assistants.read authorization event; run creation dispatched assistants.search with an incomplete value. In deployments whose custom authorization handlers register only an assistants.read handler (without an assistants.search handler and without a global fallback handler), no handler was consulted on the run-creation path, the returned filter set was empty, and the owner constraint was omitted from the resulting query.

As a result, in those deployments a request to create a run could reference a private assistant owned by another user, even where direct assistant reads, assistant search, and cron creation against that assistant were correctly denied. The run-creation response merged the referenced assistant's metadata, config, and context into fields returned to the requesting user. These fields can carry sensitive configuration; the runtime encrypts them at rest for that reason.

We have no evidence of this behavior occurring in the wild.

Affected users / systems

You may be affected if you:

run langgraph-api (the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), and
use custom authorization handlers that gate assistant access through an assistants.read or assistants.search handler rather than a global handler covering all assistant events.

Deployments without custom authorization handlers, or whose handlers apply an equivalent owner filter across all assistant events (for example through a global handler), are not affected.

Impact

Confidentiality: exposure of another user's private assistant metadata, config, and context through the run-creation response. These fields can contain sensitive configuration.
Integrity: creation of a run associated with another user's private assistant, beyond the requesting user's authorization scope; the run is then carried out using that assistant's configuration.

Patches / mitigation

Run creation, and the parallel cron-creation path, now dispatch the assistants.read authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Client-supplied run and cron metadata is no longer forwarded into that authorization event, so handlers receive a consistent value shape and determine access by returning an owner filter that is applied server-side. Fixed in langgraph-api 0.10.0.

This is a behavioral change for deployments with custom authorization handlers:

Handlers that gated assistant access only through assistants.search during run creation are no longer consulted on that path; provide an equivalent assistants.read handler that returns the same owner filter.
The metadata field on the assistants.read event during run and cron creation is no longer populated; handlers that read or stamped it should move that logic into the run/cron create handlers.

Operational guidance

Register an assistants.read handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.
Upgrade to a release containing this change.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Impacted products

Name	purl
langgraph-api	pkg:pypi/langgraph-api

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langgraph-api",
        "purl": "pkg:pypi/langgraph-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.10",
        "0.0.11",
        "0.0.12",
        "0.0.13",
        "0.0.14",
        "0.0.15",
        "0.0.16",
        "0.0.17",
        "0.0.18",
        "0.0.19",
        "0.0.2",
        "0.0.20",
        "0.0.21",
        "0.0.22",
        "0.0.23",
        "0.0.24",
        "0.0.25",
        "0.0.26",
        "0.0.27",
        "0.0.28",
        "0.0.28rc1",
        "0.0.3",
        "0.0.30",
        "0.0.31",
        "0.0.32",
        "0.0.33",
        "0.0.34",
        "0.0.36",
        "0.0.37",
        "0.0.38",
        "0.0.39",
        "0.0.4",
        "0.0.40",
        "0.0.41",
        "0.0.42",
        "0.0.43",
        "0.0.44",
        "0.0.45",
        "0.0.46",
        "0.0.47",
        "0.0.48",
        "0.0.5",
        "0.0.6",
        "0.0.7",
        "0.0.8",
        "0.0.9",
        "0.1.0",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.16",
        "0.1.17",
        "0.1.18",
        "0.1.2",
        "0.1.20",
        "0.1.21",
        "0.1.22",
        "0.1.23",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "0.10.0rc1",
        "0.10.0rc2",
        "0.10.0rc3",
        "0.2.0",
        "0.2.1",
        "0.2.10",
        "0.2.100",
        "0.2.102",
        "0.2.108",
        "0.2.109",
        "0.2.11",
        "0.2.110",
        "0.2.111",
        "0.2.113",
        "0.2.114",
        "0.2.115",
        "0.2.117",
        "0.2.12",
        "0.2.120",
        "0.2.123",
        "0.2.124",
        "0.2.125",
        "0.2.126",
        "0.2.128",
        "0.2.129",
        "0.2.13",
        "0.2.130",
        "0.2.132",
        "0.2.134",
        "0.2.135",
        "0.2.137",
        "0.2.14",
        "0.2.15",
        "0.2.16",
        "0.2.17",
        "0.2.18",
        "0.2.19",
        "0.2.2",
        "0.2.20",
        "0.2.21",
        "0.2.23",
        "0.2.24",
        "0.2.25",
        "0.2.26",
        "0.2.27",
        "0.2.28",
        "0.2.29",
        "0.2.3",
        "0.2.30",
        "0.2.32",
        "0.2.34",
        "0.2.35",
        "0.2.36",
        "0.2.37",
        "0.2.38",
        "0.2.39",
        "0.2.4",
        "0.2.40",
        "0.2.42",
        "0.2.43",
        "0.2.44",
        "0.2.45",
        "0.2.46",
        "0.2.48",
        "0.2.5",
        "0.2.51",
        "0.2.54",
        "0.2.56",
        "0.2.6",
        "0.2.60",
        "0.2.61",
        "0.2.63",
        "0.2.64",
        "0.2.66",
        "0.2.67",
        "0.2.68",
        "0.2.69",
        "0.2.7",
        "0.2.70",
        "0.2.71",
        "0.2.72",
        "0.2.75",
        "0.2.76",
        "0.2.77",
        "0.2.78",
        "0.2.8",
        "0.2.83",
        "0.2.85",
        "0.2.86",
        "0.2.88",
        "0.2.89",
        "0.2.9",
        "0.2.92",
        "0.2.94",
        "0.2.95",
        "0.2.96",
        "0.2.97",
        "0.2.98",
        "0.2.99",
        "0.3.0",
        "0.3.1",
        "0.3.4",
        "0.4.0",
        "0.4.1",
        "0.4.11",
        "0.4.14",
        "0.4.15",
        "0.4.16",
        "0.4.17",
        "0.4.18",
        "0.4.19",
        "0.4.20",
        "0.4.21",
        "0.4.22",
        "0.4.23",
        "0.4.24",
        "0.4.25",
        "0.4.26",
        "0.4.27",
        "0.4.28",
        "0.4.29",
        "0.4.30",
        "0.4.31",
        "0.4.32",
        "0.4.33",
        "0.4.34",
        "0.4.35",
        "0.4.36",
        "0.4.37",
        "0.4.38",
        "0.4.39",
        "0.4.40",
        "0.4.41",
        "0.4.42",
        "0.4.43",
        "0.4.44",
        "0.4.45",
        "0.4.46",
        "0.4.47",
        "0.4.48",
        "0.4.7",
        "0.4.9",
        "0.5.0",
        "0.5.1",
        "0.5.10",
        "0.5.11",
        "0.5.12",
        "0.5.13",
        "0.5.14",
        "0.5.15",
        "0.5.16",
        "0.5.17",
        "0.5.18",
        "0.5.19",
        "0.5.2",
        "0.5.20",
        "0.5.21",
        "0.5.22",
        "0.5.23",
        "0.5.24",
        "0.5.25",
        "0.5.26",
        "0.5.27",
        "0.5.28",
        "0.5.29",
        "0.5.3",
        "0.5.30",
        "0.5.31",
        "0.5.32",
        "0.5.33",
        "0.5.34",
        "0.5.35",
        "0.5.36",
        "0.5.37",
        "0.5.38",
        "0.5.39",
        "0.5.4",
        "0.5.40",
        "0.5.41",
        "0.5.42",
        "0.5.5",
        "0.5.6",
        "0.5.7",
        "0.5.8",
        "0.5.9",
        "0.6.0",
        "0.6.1",
        "0.6.10",
        "0.6.11",
        "0.6.12",
        "0.6.13",
        "0.6.14",
        "0.6.15",
        "0.6.16",
        "0.6.17",
        "0.6.18",
        "0.6.19",
        "0.6.2",
        "0.6.20",
        "0.6.21",
        "0.6.22",
        "0.6.23",
        "0.6.24",
        "0.6.25",
        "0.6.26",
        "0.6.27",
        "0.6.28",
        "0.6.29",
        "0.6.3",
        "0.6.30",
        "0.6.31",
        "0.6.32",
        "0.6.33",
        "0.6.34",
        "0.6.35",
        "0.6.36",
        "0.6.37",
        "0.6.38",
        "0.6.39",
        "0.6.4",
        "0.6.5",
        "0.6.6",
        "0.6.7",
        "0.6.8",
        "0.6.9",
        "0.7.0",
        "0.7.1",
        "0.7.100",
        "0.7.101",
        "0.7.102",
        "0.7.103",
        "0.7.12",
        "0.7.13",
        "0.7.14",
        "0.7.15",
        "0.7.16",
        "0.7.17",
        "0.7.18",
        "0.7.19",
        "0.7.2",
        "0.7.21",
        "0.7.22",
        "0.7.23",
        "0.7.24",
        "0.7.25",
        "0.7.26",
        "0.7.27",
        "0.7.28",
        "0.7.29",
        "0.7.3",
        "0.7.30",
        "0.7.31",
        "0.7.32",
        "0.7.33",
        "0.7.34",
        "0.7.35",
        "0.7.36",
        "0.7.37",
        "0.7.38",
        "0.7.39",
        "0.7.4",
        "0.7.40",
        "0.7.41",
        "0.7.42",
        "0.7.43",
        "0.7.44",
        "0.7.45",
        "0.7.46",
        "0.7.47",
        "0.7.48",
        "0.7.49",
        "0.7.5",
        "0.7.50",
        "0.7.51",
        "0.7.52",
        "0.7.53",
        "0.7.54",
        "0.7.55",
        "0.7.56",
        "0.7.57",
        "0.7.58",
        "0.7.59",
        "0.7.6",
        "0.7.60",
        "0.7.61",
        "0.7.62",
        "0.7.63",
        "0.7.64",
        "0.7.65",
        "0.7.66",
        "0.7.67",
        "0.7.68",
        "0.7.69",
        "0.7.7",
        "0.7.70",
        "0.7.71",
        "0.7.72",
        "0.7.73",
        "0.7.74",
        "0.7.75",
        "0.7.76",
        "0.7.77",
        "0.7.78",
        "0.7.79",
        "0.7.8",
        "0.7.80",
        "0.7.81",
        "0.7.82",
        "0.7.83",
        "0.7.84",
        "0.7.85",
        "0.7.86",
        "0.7.87",
        "0.7.88",
        "0.7.89",
        "0.7.9",
        "0.7.90",
        "0.7.91",
        "0.7.92",
        "0.7.93",
        "0.7.94",
        "0.7.95",
        "0.7.96",
        "0.7.97",
        "0.7.98",
        "0.7.99",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.8.6",
        "0.8.7",
        "0.9.0",
        "0.9.0.dev1",
        "0.9.0.dev2",
        "0.9.0.dev3",
        "0.9.0.dev4",
        "0.9.0.dev5",
        "0.9.0.dev6",
        "0.9.0rc1",
        "0.9.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55236",
    "GHSA-jfj5-wrj9-63x4"
  ],
  "details": "## Summary\n\nIn affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the `assistants.read` authorization event; run creation dispatched `assistants.search` with an incomplete value. In deployments whose custom authorization handlers register only an `assistants.read` handler (without an `assistants.search` handler and without a global fallback handler), no handler was consulted on the run-creation path, the returned filter set was empty, and the owner constraint was omitted from the resulting query.\n\nAs a result, in those deployments a request to create a run could reference a private assistant owned by another user, even where direct assistant reads, assistant search, and cron creation against that assistant were correctly denied. The run-creation response merged the referenced assistant\u0027s `metadata`, `config`, and `context` into fields returned to the requesting user. These fields can carry sensitive configuration; the runtime encrypts them at rest for that reason.\n\nWe have no evidence of this behavior occurring in the wild.\n\n## Affected users / systems\n\nYou may be affected if you:\n\n- run `langgraph-api` (the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), and\n- use custom authorization handlers that gate assistant access through an `assistants.read` or `assistants.search` handler rather than a global handler covering all assistant events.\n\nDeployments without custom authorization handlers, or whose handlers apply an equivalent owner filter across all assistant events (for example through a global handler), are not affected.\n\n## Impact\n\n- Confidentiality: exposure of another user\u0027s private assistant `metadata`, `config`, and `context` through the run-creation response. These fields can contain sensitive configuration.\n- Integrity: creation of a run associated with another user\u0027s private assistant, beyond the requesting user\u0027s authorization scope; the run is then carried out using that assistant\u0027s configuration.\n\n## Patches / mitigation\n\nRun creation, and the parallel cron-creation path, now dispatch the `assistants.read` authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Client-supplied run and cron metadata is no longer forwarded into that authorization event, so handlers receive a consistent value shape and determine access by returning an owner filter that is applied server-side. Fixed in `langgraph-api` 0.10.0.\n\nThis is a behavioral change for deployments with custom authorization handlers:\n\n- Handlers that gated assistant access only through `assistants.search` during run creation are no longer consulted on that path; provide an equivalent `assistants.read` handler that returns the same owner filter.\n- The metadata field on the `assistants.read` event during run and cron creation is no longer populated; handlers that read or stamped it should move that logic into the run/cron create handlers.\n\n## Operational guidance\n\n- Register an `assistants.read` handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.\n- Upgrade to a release containing this change.",
  "id": "PYSEC-2026-3858",
  "modified": "2026-09-10T11:02:12.014480Z",
  "published": "2026-09-10T09:44:51.663830Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/helm/security/advisories/GHSA-jfj5-wrj9-63x4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/helm"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/langgraph-api"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-jfj5-wrj9-63x4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55236"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "langgraph-api: Incomplete assistant authorization in LangGraph Server run creation"
}

CVE-2026-55236 (GCVE-0-2026-55236)

Vulnerability from cvelistv5 – Published: 2026-09-14 15:51 – Updated: 2026-09-14 16:42

Title

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cron creation. In deployments with custom resource handlers that register only assistants.read, omit an assistants.search handler, and have no global fallback handler, no applicable handler supplies an owner filter, allowing a low-privileged user to reference another user's private assistant through POST /runs or POST /threads/{thread_id}/runs. The run-creation response can disclose the private assistant's metadata, config, and context, and the run can execute using that assistant's configuration. Deployments without custom authorization handlers, or with an equivalent owner filter applied through a global handler or across all assistant events, are not affected. This issue is fixed in version 0.10.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:41 UTC

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/langchain-ai/helm/security/adv…	x_refsource_CONFIRM
https://github.com/langchain-ai/docs/blob/7b70fba…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
langchain-ai	langgraph-api	Affected: < 0.10.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:41:45.325753Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:42:03.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langgraph-api",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cron creation. In deployments with custom resource handlers that register only assistants.read, omit an assistants.search handler, and have no global fallback handler, no applicable handler supplies an owner filter, allowing a low-privileged user to reference another user\u0027s private assistant through POST /runs or POST /threads/{thread_id}/runs. The run-creation response can disclose the private assistant\u0027s metadata, config, and context, and the run can execute using that assistant\u0027s configuration. Deployments without custom authorization handlers, or with an equivalent owner filter applied through a global handler or across all assistant events, are not affected. This issue is fixed in version 0.10.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T15:52:18.257Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langchain-ai/helm/security/advisories/GHSA-jfj5-wrj9-63x4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langchain-ai/helm/security/advisories/GHSA-jfj5-wrj9-63x4"
        },
        {
          "name": "https://github.com/langchain-ai/docs/blob/7b70fbacab21f84d9c6f9848f86cdeb471adbb50/src/langsmith/agent-server-changelog.mdx",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langchain-ai/docs/blob/7b70fbacab21f84d9c6f9848f86cdeb471adbb50/src/langsmith/agent-server-changelog.mdx"
        }
      ],
      "source": {
        "advisory": "GHSA-jfj5-wrj9-63x4",
        "discovery": "UNKNOWN"
      },
      "title": "langgraph-api: Incomplete assistant authorization in LangGraph Server run creation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55236",
    "datePublished": "2026-09-14T15:51:17.118Z",
    "dateReserved": "2026-06-16T16:44:00.623Z",
    "dateUpdated": "2026-09-14T16:42:03.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-JFJ5-WRJ9-63X4

Vulnerability from github – Published: 2026-08-19 18:56 – Updated: 2026-08-19 18:56

Summary

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Details

Summary

We have no evidence of this behavior occurring in the wild.

Affected users / systems

You may be affected if you:

run langgraph-api (the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), and
use custom authorization handlers that gate assistant access through an assistants.read or assistants.search handler rather than a global handler covering all assistant events.

Deployments without custom authorization handlers, or whose handlers apply an equivalent owner filter across all assistant events (for example through a global handler), are not affected.

Impact

Confidentiality: exposure of another user's private assistant metadata, config, and context through the run-creation response. These fields can contain sensitive configuration.
Integrity: creation of a run associated with another user's private assistant, beyond the requesting user's authorization scope; the run is then carried out using that assistant's configuration.

Patches / mitigation

This is a behavioral change for deployments with custom authorization handlers:

Handlers that gated assistant access only through assistants.search during run creation are no longer consulted on that path; provide an equivalent assistants.read handler that returns the same owner filter.
The metadata field on the assistants.read event during run and cron creation is no longer populated; handlers that read or stamped it should move that logic into the run/cron create handlers.

Operational guidance

Register an assistants.read handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.
Upgrade to a release containing this change.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langgraph-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55236"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-19T18:56:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nIn affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the `assistants.read` authorization event; run creation dispatched `assistants.search` with an incomplete value. In deployments whose custom authorization handlers register only an `assistants.read` handler (without an `assistants.search` handler and without a global fallback handler), no handler was consulted on the run-creation path, the returned filter set was empty, and the owner constraint was omitted from the resulting query.\n\nAs a result, in those deployments a request to create a run could reference a private assistant owned by another user, even where direct assistant reads, assistant search, and cron creation against that assistant were correctly denied. The run-creation response merged the referenced assistant\u0027s `metadata`, `config`, and `context` into fields returned to the requesting user. These fields can carry sensitive configuration; the runtime encrypts them at rest for that reason.\n\nWe have no evidence of this behavior occurring in the wild.\n\n## Affected users / systems\n\nYou may be affected if you:\n\n- run `langgraph-api` (the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), and\n- use custom authorization handlers that gate assistant access through an `assistants.read` or `assistants.search` handler rather than a global handler covering all assistant events.\n\nDeployments without custom authorization handlers, or whose handlers apply an equivalent owner filter across all assistant events (for example through a global handler), are not affected.\n\n## Impact\n\n- Confidentiality: exposure of another user\u0027s private assistant `metadata`, `config`, and `context` through the run-creation response. These fields can contain sensitive configuration.\n- Integrity: creation of a run associated with another user\u0027s private assistant, beyond the requesting user\u0027s authorization scope; the run is then carried out using that assistant\u0027s configuration.\n\n## Patches / mitigation\n\nRun creation, and the parallel cron-creation path, now dispatch the `assistants.read` authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Client-supplied run and cron metadata is no longer forwarded into that authorization event, so handlers receive a consistent value shape and determine access by returning an owner filter that is applied server-side. Fixed in `langgraph-api` 0.10.0.\n\nThis is a behavioral change for deployments with custom authorization handlers:\n\n- Handlers that gated assistant access only through `assistants.search` during run creation are no longer consulted on that path; provide an equivalent `assistants.read` handler that returns the same owner filter.\n- The metadata field on the `assistants.read` event during run and cron creation is no longer populated; handlers that read or stamped it should move that logic into the run/cron create handlers.\n\n## Operational guidance\n\n- Register an `assistants.read` handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.\n- Upgrade to a release containing this change.",
  "id": "GHSA-jfj5-wrj9-63x4",
  "modified": "2026-08-19T18:56:03Z",
  "published": "2026-08-19T18:56:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/helm/security/advisories/GHSA-jfj5-wrj9-63x4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/helm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "langgraph-api: Incomplete assistant authorization in LangGraph Server run creation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

PYSEC-2026-3858

Summary

Affected users / systems

Impact

Patches / mitigation

Operational guidance

CVE-2026-55236 (GCVE-0-2026-55236)

GHSA-JFJ5-WRJ9-63X4

Summary

Affected users / systems

Impact

Patches / mitigation

Operational guidance

Tags

Sightings

Nomenclature