CVE-2026-55235: LangChain langgraph-api authentication bypass in webhook routing

CVE-2026-55235 · Severity: medium · CVSS 5.9 · Published 2026-09-14

LangGraph Server is a runtime for managing AI agent execution flows and thread/run state. The server allows webhooks to be configured for event notifications, but a flaw in its webhook delivery mechanism bypasses authentication for loopback-routed requests. An authenticated user can specify a relative webhook URL that causes the server to make internal requests without authentication context, allowing them to create or modify runs and threads belonging to other users, and leak limited metadata from other users' threads.

Technologies: langgraph-api (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55235 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55235 being exploited in the wild.
How severe is CVE-2026-55235?
Medium severity, with a CVSS score of 5.9, published 14 September 2026.
Which products and versions are affected?
langgraph-api (PyPI) < 0.10.0, ECOSYSTEM:introduced=0,fixed=0.10.0.
Is there a fix for CVE-2026-55235?
Yes. langgraph-api (PyPI): upgrade to 0.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55235 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55235?
Check whether you run langgraph-api (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langgraph-api (PyPI): upgrade to 0.10.0 or later
    pip install "langgraph-api>=0.10.0"

Technical details

The vulnerability is an authentication bypass caused by improper trust of in-process loopback transport. When a run or cron is created with a relative webhook target, the server later delivers the webhook by routing it through an in-process loopback transport. The authentication middleware treats this loopback delivery as internal and skips authentication checks, even though the request originated from an external user action. In multi-tenant deployments that scope threads and runs by owner, this allows an authenticated user to specify a webhook URL that targets another user's resources. The attacker can create a run on or modify the state of another user's thread, and limited thread metadata is incorporated into the created run record. Attack requires: (1) ability to create runs/crons with custom webhook targets, (2) multi-user environment with per-user authorization, (3) low privileges (authenticated user). Fixed in langgraph-api 0.10.0 by denying loopback delivery by default via the `webhooks.url.disable_loopback` policy.

Affected products

  • LangChain langgraph-api < 0.10.0

Identifiers

  • CVE-2026-55235
  • GHSA-2c9q-c2q9-qgqv
  • PYSEC-2026-3857

Timeline

  • 2026-06-11: disclosed
  • 2026-08-19: advisory
  • 2026-08-19: patched: Fixed in langgraph-api 0.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.