Advisories

`langgraph deploy --verbose` in `langgraph-cli` 0.4.15 through 0.4.31 printed the temporary registry push token that the CLI passes to `docker login --password-stdin`. Anyone who could read that output, such as CI logs, could use the token for up to 12 hours, limited to the deployment's image repository, to pull images and push new ones.

The LangGraph Python SDK v3 streaming client, in `langgraph-sdk` versions 0.4.0 through 0.4.5, inserts caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them, in the `get_tree` and `_fetch_state` implementations. Relative path segments in these values can redirect an authenticated GET request to another readable path on the configured server, and the SDK returns that response to the application. `RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when it pairs with a vulnerable SDK version.

The Postgres and SQLite stores in LangGraph joined namespace labels with `.`, so a label containing a dot, such as `("tenant.bob",)`, mapped to the same stored namespace as `("tenant", "bob")`. Although `put` rejected such labels, `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed to `batch`/`abatch` did not, letting a caller read, overwrite or delete items in another namespace. All releases of `langgraph-checkpoint-postgres` before 3.1.3 and `langgraph-checkpoint-sqlite` before 3.1.2 are affected, while `InMemoryStore` is not.

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0, in the get_secret function of secret_managers/main.py within the Secret Resolution component. Manipulating the api_key argument leads to improper authorization, and the attack can be initiated remotely. The exploit is public and may be used, and the vendor did not respond after early contact.

In affected versions of `langgraph-api`, run creation checked assistant authorization with an incomplete `assistants.search` event rather than `assistants.read`. In deployments whose custom handlers register only an `assistants.read` handler, no handler ran on that path and the owner constraint was dropped, so a run could reference another user's private assistant. The response then returned that assistant's `metadata`, `config` and `context`. The source reports no evidence of exploitation in the wild.

In affected versions of langgraph-api (the LangGraph Server runtime), a run or cron created with a relative webhook target was delivered through an in-process loopback transport that the authentication middleware treats as internal and does not authenticate. This let such requests reach thread and run routes without the usual authentication context, so in deployments that scope data by owner, one user could create a run on or modify another user's thread, and limited thread metadata could appear in the created run record.

The Postgres and SQLite stores in LangGraph matched scoped namespace reads with LIKE on a dot-joined string, so a scoped search or list_namespaces could also return items from sibling namespaces that share leading characters, such as foo and foobar. Namespace labels containing _ or % were also interpreted as pattern metacharacters, letting user_1 match userX1, and the list_namespaces suffix condition could match sibling leaves like users.malice. The flaw is a confidentiality issue in read paths only where namespaces serve as a tenant or user boundary, and the source reports no evidence of exploitation in the wild.

The langgraph-sdk builds HTTP request paths by interpolating caller-supplied identifier values into URL templates without sanitization. Identifiers containing URL-special characters can address a different resource or resource type than the call site indicates, potentially exposing, modifying or deleting resources beyond the caller's authorization scope.

LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads, so an attacker with write access to checkpoint bytes at rest could potentially trigger code execution at checkpoint load time. The issue is classed as defense-in-depth: it is reachable only when an unauthorized party can modify the checkpoint store, and the team reports no evidence of exploitation in the wild. The default serializer in PostgresSaver, SqliteSaver and their async counterparts is JsonPlusSerializer, so applications generally fall in scope without opting in.

LangChain versions prior to 1.3.9 contain several components that resolve filesystem paths or expand search patterns without confining results to the intended root directory. The file-search agent middleware validates only the starting directory, so glob patterns and symlinks can reach files outside the configured root, and prompt and agent configuration loaders accept path fields without confinement or symlink rejection. When these components receive path values or search patterns influenced by an untrusted source, including an LLM acting on untrusted input, they can disclose files outside the intended boundary.

A vulnerability in BerriAI litellm up to version 1.82.2 affects the json.dumps function in litellm/proxy/management_endpoints/ui_sso.py, part of the SSO Debug Flow component. Manipulating this component can lead to missing authentication, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used, and the vendor was contacted early about the disclosure.