Vulnerability in LangGraph API Facilitates Unauthorized Webhook Access
CVE-2026-55235

5.9MEDIUM

Key Information:

Vendor

Langchain-ai

Status
Langgraph-api
Vendor
CVE Published:
14 September 2026

What is CVE-2026-55235?

The langgraph-api, used for rapid development and testing, contains a flaw that allows an authenticated user to redirect webhooks to the server's thread via an internal loopback transport. This vulnerability arises when per-user authorization is compromised, enabling attackers to manipulate other users' runs and threads by exploiting the authentication mechanism, which incorrectly treats internal transports as secure. Deployments reliant on webhook configurations without strict controls over loopback delivery should be cautious, as ramifications can lead to unauthorized data exposure and manipulation. This issue has been addressed in version 0.10.0.

Affected Version(s)

langgraph-api < 0.10.0

References

https://github.com/langchain-ai/helm/security/advisories/...
x_refsource_CONFIRM
https://github.com/langchain-ai/docs/blob/7b70fbacab21f84...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.