Junglewise Threat Intelligence

CVE-2026-55235: LangChain langgraph-api authentication bypass in webhook routing

CVE-2026-55235 · Severity: medium · CVSS 5.9 · Published 2026-08-19

Executive brief

LangGraph Server is a runtime for managing AI agent execution flows and thread/run state. The server allows webhooks to be configured for event notifications, but a flaw in its webhook delivery mechanism bypasses authentication for loopback-routed requests. An authenticated user can specify a relative webhook URL that causes the server to make internal requests without authentication context, allowing them to create or modify runs and threads belonging to other users, and leak limited metadata from other users' threads.

Technical details

The vulnerability is an authentication bypass caused by improper trust of in-process loopback transport. When a run or cron is created with a relative webhook target, the server later delivers the webhook by routing it through an in-process loopback transport. The authentication middleware treats this loopback delivery as internal and skips authentication checks, even though the request originated from an external user action. In multi-tenant deployments that scope threads and runs by owner, this allows an authenticated user to specify a webhook URL that targets another user's resources. The attacker can create a run on or modify the state of another user's thread, and limited thread metadata is incorporated into the created run record. Attack requires: (1) ability to create runs/crons with custom webhook targets, (2) multi-user environment with per-user authorization, (3) low privileges (authenticated user). Fixed in langgraph-api 0.10.0 by denying loopback delivery by default via the `webhooks.url.disable_loopback` policy.

Affected products

  • LangChain langgraph-api < 0.10.0

Timeline

  • 2026-06-11: disclosed
  • 2026-08-19: advisory
  • 2026-08-19: patched: Fixed in langgraph-api 0.10.0

References

Related threats