{"data":{"id":"b3406cbb-10fd-42e3-8578-95bc7a19dbba","title":"GHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store access","summary":"LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. An authenticated user may then read, overwrite, search, or delete another user's Store data, provided the handler relies on namespace rewriting and multiple users' data is stored through that path.","solution":"Fixed in langgraph-api version 0.15.0; users should upgrade to langgraph-api>=0.15.0. Deployments that cannot upgrade immediately should change JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces rather than rewriting them, applied to every Store action the deployment exposes.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-4hm6-w6qq-w73v","publishedAt":"2026-10-28T21:09:42.000Z","cveId":"CVE-2026-118668","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langgraph-api@>= 0.1.2, < 0.15.0 (fixed: 0.15.0)"],"affectedPackageNames":["langgraph-api"],"affectedPackageRefs":["pypi:langgraph-api"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangGraph","langgraph-api"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-29T00:11:01.292Z","kevDateAdded":null,"advisoryAliases":["GHSA-4hm6-w6qq-w73v"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-28T21:09:42.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}