Executive brief
LangGraph Server is a runtime platform for deploying AI agent workflows. In affected versions, the run creation endpoint failed to properly authorize which assistants (AI configurations) a user could access, allowing an authenticated user to create workflow runs using private assistants owned by other users. The response would expose the private assistant's sensitive metadata, configuration, and context—which may include API keys, credentials, or system prompts—creating both data exposure and unauthorized workflow execution risks.
Technical details
The vulnerability stems from incomplete authorization logic (CWE-285) in the run-creation code path. While assistant reads and cron creation dispatch the assistants.read authorization event, run creation dispatched assistants.search with incomplete parameters. In deployments with custom authorization handlers registering only an assistants.read handler (without a global fallback), the run-creation path skipped authorization entirely, omitting the owner constraint from database queries. An authenticated attacker could POST to the run-creation endpoint referencing another user's private assistant by ID; the server would execute the run and return the referenced assistant's metadata, config, and context in the response. Attack requires low privileges (authenticated user account) and network reachability to the LangGraph API. No user interaction needed. Fixed in langgraph-api 0.10.0 by aligning run/cron creation to use the assistants.read event consistently with other code paths.
Affected products
- LangChain langgraph-api < 0.10.0
Timeline
- 2026-06-11: disclosed
- 2026-08-19: advisory: GitHub Advisory Database publication
- 2026-08-19: patched: Fixed in langgraph-api 0.10.0