CVE-2026-104873: LangChain LangGraph Python SDK resource authorization bypass

CVE-2026-104873 · Severity: high · CVSS 4 · Published 2026-10-02

LangGraph Python SDK connects applications to LangGraph API servers to manage assistants, threads, and conversation runs. In affected versions, authorization decorators that were meant to restrict access to specific actions instead granted access to all actions on a resource, allowing authenticated attackers to bypass permission checks and read, update, or delete other users' assistants, threads, and scheduled jobs without proper authorization.

Technologies: langgraph-sdk (PyPI). Vendors: LangChain, PyPI.

Quick answers

Is CVE-2026-104873 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-104873 being exploited in the wild.
How severe is CVE-2026-104873?
High severity, with a CVSS score of 4, published 2 October 2026.
Which products and versions are affected?
LangChain LangGraph Python SDK 0.1.45 to 0.4.3; langgraph-sdk (PyPI) >= 0.1.45, <= 0.4.3, ECOSYSTEM:introduced=0.1.45,fixed=0.4.4.
Is there a fix for CVE-2026-104873?
Yes. langgraph-sdk (PyPI): upgrade to 0.4.4 or later. Until then: Ensure the selected authorization handler independently enforces all required checks for every action it receives; configure a global default-deny handler for deployments using action-scoped handlers. Upgrade to version 0.4.4 or later.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-02"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104873 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-104873?
Check whether you run LangChain LangGraph Python SDK or langgraph-sdk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langgraph-sdk (PyPI): upgrade to 0.4.4 or later
    pip install "langgraph-sdk>=0.4.4"

Ensure the selected authorization handler independently enforces all required checks for every action it receives; configure a global default-deny handler for deployments using action-scoped handlers. Upgrade to version 0.4.4 or later.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-02"}]

Technical details

The resource-scoped authorization decorators (@auth.on.threads, @auth.on.assistants, @auth.on.crons) ignore their actions argument and register handlers for every action on the specified resource. Because these wildcard handlers are selected before fallback handlers, authenticated users can bypass action, ownership, and permission checks. The vulnerability affects Python deployments using action-scoped decorators; deployments that enforce checks within each handler are protected. This is a path traversal in the authorization handler matching logic.

Affected products

  • LangChain LangGraph Python SDK 0.1.45 to 0.4.3

Identifiers

  • CVE-2026-104873
  • GHSA-fvww-7h3r-vfhp
  • PYSEC-2026-4240

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.