# CVE-2026-118667: LangChain LangGraph path traversal in RemoteGraph streaming

Source: https://junglewise.ai/threats/cve-2026-118667-langgraph-python-sdk-is-used-to-connect-to-running-langgraph-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118667 · Severity: medium · CVSS 4.3 · Published 2026-10-28

LangGraph is a Python SDK that connects applications to LangGraph API servers to manage AI workflows. A path traversal vulnerability in versions 0.4.0-0.4.5 and 1.2.3-1.2.13 allows attackers with knowledge of internal thread or assistant IDs to access unauthorized data on the same API server by crafting malicious identifiers that bypass URL encoding. The vulnerability affects remote graph streaming operations and could expose sensitive conversation data or model configurations.

Technologies: [langgraph (PyPI)](https://junglewise.ai/threats/technologies/langgraph), [langgraph-sdk (PyPI)](https://junglewise.ai/threats/technologies/pypi-langgraph-sdk). Vendors: [LangChain](https://junglewise.ai/threats/vendors/langchain), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-118667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118667 being exploited in the wild.

**How severe is CVE-2026-118667?** Medium severity, with a CVSS score of 4.3, published 28 October 2026.

**Which products and versions are affected?** LangChain Langgraph 1.2.3 to 1.2.13; LangChain LangGraph SDK 0.4.0 to 0.4.5; langgraph (PyPI) >= 1.2.3, < 1.2.14, ECOSYSTEM:introduced=1.2.3,fixed=1.2.14; langgraph-sdk (PyPI) >= 0.4.0, < 0.4.6, ECOSYSTEM:introduced=0.4.0,fixed=0.4.6.

**Is there a fix for CVE-2026-118667?** Yes. langgraph (PyPI): upgrade to 1.2.14 or later; langgraph-sdk (PyPI): upgrade to 0.4.6 or later. Until then: Ensure thread_id and assistant_id values are validated and sanitized on the server side to reject identifiers containing path traversal characters (.., /, #) before they are used in API operations.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-28"
  },
  {
    "kind": "patched",
    "at": "2026-10-06",
    "note": "Fix merged to main branch; langgraph-sdk 0.4.6 and langgraph 1.2.14 released"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118667 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118667?** Check whether you run LangChain Langgraph, LangChain LangGraph SDK, langgraph (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langgraph (PyPI): upgrade to 1.2.14 or later

  ```sh
  pip install "langgraph>=1.2.14"
  ```

- langgraph-sdk (PyPI): upgrade to 0.4.6 or later

  ```sh
  pip install "langgraph-sdk>=0.4.6"
  ```


Ensure thread_id and assistant_id values are validated and sanitized on the server side to reject identifiers containing path traversal characters (.., /, #) before they are used in API operations.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-28"
  },
  {
    "kind": "patched",
    "at": "2026-10-06",
    "note": "Fix merged to main branch; langgraph-sdk 0.4.6 and langgraph 1.2.14 released"
  }
]

## Technical details

The vulnerability exists in v3 stream helpers (get_tree and _fetch_state) that construct authenticated REST request paths by directly interpolating caller-controlled assistant_id and thread_id values without URL encoding via _quote_path_param. An attacker can inject path traversal sequences like ".." or URL fragments "#" in these identifiers; the HTTP client (httpx) normalizes the unencoded segments before the request is sent, allowing navigation to unintended API paths while retaining authentication headers. This affects both synchronous and asynchronous stream implementations.

## Affected products

- LangChain langgraph-sdk 0.4.0 to 0.4.5
- LangChain langgraph 1.2.3 to 1.2.13

## Identifiers

- CVE-2026-118667
- GHSA-3fx2-cqw9-xr3c

## References

- [https://github.com/langchain-ai/langgraph/commit/d89c7e100ec6fc1512544d23b0a7c5169699ef3e](https://github.com/langchain-ai/langgraph/commit/d89c7e100ec6fc1512544d23b0a7c5169699ef3e)
- [https://github.com/langchain-ai/langgraph/pull/9213](https://github.com/langchain-ai/langgraph/pull/9213)

## Related threats

- [LangGraph checkpoint savers namespace validation bypass in SQLite and Postgres](https://junglewise.ai/threats/cve-2026-115883-langgraph-checkpoint-savers-provide-postgres-and-sqlite-backed)
- [LangChain LangGraph Python SDK resource authorization bypass](https://junglewise.ai/threats/cve-2026-104873-langgraph-python-sdk-is-used-to-connect-to-running-langgraph-api)
- [LangChain LangGraph SDK path traversal in URL construction](https://junglewise.ai/threats/cve-2026-48776-langchain-langgraph-sdk-path-traversal-in-url-construction)
- [LangChain LangGraph unsafe msgpack deserialization in checkpointers](https://junglewise.ai/threats/cve-2026-28277-langchain-langgraph-unsafe-msgpack-deserialization-in)