GHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

Summary

The LangGraph Python SDK v3 streaming client, in `langgraph-sdk` versions 0.4.0 through 0.4.5, inserts caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them, in the `get_tree` and `_fetch_state` implementations. Relative path segments in these values can redirect an authenticated GET request to another readable path on the configured server, and the SDK returns that response to the application. `RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when it pairs with a vulnerable SDK version.

Mitigation

Upgrade `langgraph-sdk` to version 0.4.6 or later. If you use `RemoteGraph`, also upgrade `langgraph` to version 1.2.14 or later, which requires `langgraph-sdk>=0.4.6`.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langgraphPyPILLM dependency since 2024-01-08 · 16 tracked dependents
• langgraph-sdkPyPILLM dependency since 2024-05-02 · 3 tracked dependents

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database
• HighCVE-2026-106119: LangChain MongoDBChatMessageHistory query injection via session identifierSame vendor · NVD/CVE Database