CVE-2026-118668: LangGraph API JavaScript custom authentication namespace bypass

CVE-2026-118668 · Severity: high · CVSS 4 · Published 2026-10-28

LangGraph API is a framework for building and testing AI workflows that stores application data in a backend Store. In versions 0.1.2 through 0.15.0, deployments using JavaScript or TypeScript custom authentication with namespace-based access control are vulnerable to a bypass that allows authenticated users to read, modify, or delete other users' data. This breaks data isolation between users and could lead to widespread unauthorized data access in multi-tenant deployments.

Technologies: langgraph-api (PyPI). Vendors: LangChain, PyPI.

Quick answers

Is CVE-2026-118668 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118668 being exploited in the wild.
How severe is CVE-2026-118668?
High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?
LangChain Langgraph-Api 0.1.2 to 0.15.0; langgraph-api (PyPI) >= 0.1.2, < 0.15.0, ECOSYSTEM:introduced=0.1.2,fixed=0.15.0.
Is there a fix for CVE-2026-118668?
Yes. langgraph-api (PyPI): upgrade to 0.15.0 or later. Until then: Until upgrading, modify JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces rather than rewriting them. This workaround must be applied to every Store action exposed by the deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118668 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118668?
Check whether you run LangChain Langgraph-Api or langgraph-api (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langgraph-api (PyPI): upgrade to 0.15.0 or later
    pip install "langgraph-api>=0.15.0"

Until upgrading, modify JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces rather than rewriting them. This workaround must be applied to every Store action exposed by the deployment.

Technical details

The vulnerability exists in the JavaScript/TypeScript authentication handler path where namespace rewriting performed by authorization handlers is not propagated across the runtime boundary to the Store operation. An authenticated attacker can exploit this by requesting a namespace that the handler rewrites to restrict access, but the rewritten namespace is discarded before the Store operation executes, allowing access to the original unauthorized namespace. Python handlers and handlers that reject (rather than rewrite) unauthorized namespaces are not affected.

Affected products

  • LangChain langgraph-api 0.1.2 to 0.15.0

Identifiers

  • CVE-2026-118668
  • GHSA-4hm6-w6qq-w73v

Timeline

  • 2026-09-28: disclosed
  • 2026-10-28: patched: Version 0.15.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.