CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
Authenticated users can bypass action-specific authorization checks in LangGraph SDK decorators, allowing unauthorized access to other users' resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104873?
CVE-2026-104873 is a high-severity missing authorization vulnerability in langchain-ai langgraph, published on 2 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on the resource. Because that wildcard resource handler is selected before broader fallback handlers, an authenticated user may bypass fallback action, ownership, or permission checks and read, update, or delete another user's resource. Only Python deployments using actions on the affected decorators are vulnerable, and a deployment remains protected when the selected handler independently enforces all required checks for every action it receives. This issue is fixed in version 0.4.4.
Weakness: CWE-863
Which versions are affected by CVE-2026-104873?
3 open source packages ship an affected version, including langgraph-sdk.
| Package | Affected | Fixed in |
|---|---|---|
langgraph-sdk PyPI | From 0.1.45 | 0.4.4 |
langgraph-sdk PyPI | From 0.1.45 | 0.4.4 |
langgraph-sdk PyPI | From 0.1.45 | 0.4.4 |
Linux distribution packages (1)
python-langgraph-sdk openSUSE:Tumbleweed | All versions | 0.4.9-1.1 |
How do I fix CVE-2026-104873?
Upgrade langgraph-sdk to 0.4.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104873 being exploited?
There is no known exploitation of CVE-2026-104873 in the wild and no public exploit code.
Sources
Also known as ECHO-af4a-f4a1-bc1c, GHSA-fvww-7h3r-vfhp, PYSEC-2026-4240, ROOT-APP-PYPI-CVE-2026-104873, openSUSE-SU-2026:12279-1.