CVE-2026-118667 LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118667?
CVE-2026-118667 is a medium-severity vulnerability in langchain-ai langgraph, published on 28 Oct 2026.
Official description
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.
Weakness: CWE-22
Which versions are affected by CVE-2026-118667?
4 open source packages ship an affected version, including langgraph and langgraph-sdk.
| Package | Affected | Fixed in |
|---|---|---|
langgraph PyPI | From 1.2.3 | 1.2.14 |
langgraph PyPI | From 1.2.3 | 1.2.14 |
langgraph-sdk PyPI | From 0.4.0 | 0.4.6 |
langgraph-sdk PyPI | From 0.4.0 | 0.4.6 |
How do I fix CVE-2026-118667?
Upgrade langgraph to 1.2.14 or later.
Is CVE-2026-118667 being exploited?
There is no known exploitation of CVE-2026-118667 in the wild and no public exploit code.
Sources
Also known as GHSA-3fx2-cqw9-xr3c.