AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-jfj5-wrj9-63x4: langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

mediumvulnerability

security

Source: GitHub Advisory DatabaseAugust 19, 2026CVE-2026-55236

Summary

LangGraph Server had an authorization bug where creating a run could bypass security checks and access another user's private assistant if custom authorization handlers only registered an `assistants.read` handler (a permission check for reading assistants). This allowed the requesting user to see sensitive configuration data like metadata, config, and context from assistants they shouldn't have access to.

Solution / Mitigation

Run creation and cron-creation paths now dispatch the `assistants.read` authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Fixed in `langgraph-api` 0.10.0. Deployments with custom handlers should register an `assistants.read` handler that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.