Vulnerability in LangGraph Python SDK Affects Resource Management
CVE-2026-48776

4.2MEDIUM

Key Information:

Vendor

Langchain-ai

Status
Langchain-ai
Langchain-sdk
Vendor
CVE Published:
16 June 2026

What is CVE-2026-48776?

The LangGraph Python SDK, utilized for managing connections to LangGraph API servers, is vulnerable due to unsafe URL path construction. This vulnerability arises when unsanitized caller-supplied identifier values are included in HTTP request paths for resource operations. Specifically, versions 0.3.14 and earlier fail to properly validate these identifier values, which can lead to unintended access, modification, or deletion of resources outside the authorized user's scope. This is particularly critical when deployments involve forwarding end-user inputs without validation, allowing potentially malicious requests to bypass intended security measures. The vulnerability is addressed in version 0.3.15.

Affected Version(s)

langchain-ai < 1.2.1

langchain-sdk < 0.3.15

References

https://github.com/langchain-ai/langgraph/security/adviso...
x_refsource_CONFIRM
https://github.com/langchain-ai/langgraph/releases/tag/sd...
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.