CVE-2026-48776 LangGraph SDK has unsafe URL path construction
Attackers can manipulate URL paths to access or modify unauthorized resources if untrusted identifiers are passed to the LangGraph SDK without validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48776?
CVE-2026-48776 is a medium-severity path traversal vulnerability in langchain-ai, published on 16 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to address a different resource (and potentially a different resource type) than the SDK method's call site indicates. In deployments where the SDK receives identifier values that originate from untrusted sources, this could result in unintended access, modification, or deletion of resources beyond the calling user's authorization scope. This issue is most consequential in deployments that forward end-user-supplied values directly into SDK identifier parameters without first validating them against an expected format (such as a UUID), and rely on URL-prefix-based authorization at an upstream layer (reverse proxy, edge gateway, WAF), where the authorization decision is made on the SDK call's intended path rather than on the final delivered request path. The issue has been fixed in version 0.3.15.
Which versions are affected by CVE-2026-48776?
4 open source packages ship an affected version, including langgraph-sdk and langgraph. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langgraph-sdk PyPI | All versions | 0.3.15 |
langgraph-sdk PyPI | All versions | 0.3.15 |
langgraph-sdk PyPI | All versions | 0.3.15 |
langgraph PyPI | All versions | 0.3.15 |
Products include Langchain Langgraph-Sdk.
How do I fix CVE-2026-48776?
Upgrade langgraph-sdk to 0.3.15 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-48776 being exploited?
There is no known exploitation of CVE-2026-48776 in the wild and no public exploit code.
Sources
Also known as GHSA-w39p-vh2g-g8g5, PYSEC-2026-2194, PYSEC-2026-2575, ROOT-APP-PYPI-CVE-2026-48776.