GHSA-FVWW-7H3R-VFHP LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +470 more potentially affected by CVE-2026-104873 via langgraph-sdk (>=0.1.48, <=0.4.3)

langgraph-sdk PYPI version =0.1.48, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-104873 Source advisory: GHSA-FVWW-7H3R-VFHP...

EUVD-2026-91794

LangGraph SDK custom auth silently ignores actions= on resource decorators...

Incorrect Authorization

Overview langgraph-sdk is a SDK for interacting with LangGraph API Affected versions of this package are vulnerable to Incorrect Authorization via the ResourceOn.call method in langgraphsdk/auth/init.py, where custom authorization handlers registered with resource-specific decorators fail to...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +470 more potentially affected by CVE-2026-104873 via langgraph-sdk (>=0.1.48, <=0.4.3)

langgraph-sdk PYPI version =0.1.48, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-104873 Source advisory: SNYK:PYTHON-LANGGRAPHSDK-20417225...

CVE-2026-104873

A flaw was found in langgraph-sdk. This vulnerability allows an authenticated attacker to bypass authorization controls to access, modify, or delete resources belonging to other users. The issue occurs because resource-scoped authorization decorators fail to restrict handlers to specified actions...

CVE-2026-104873

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +470 more potentially affected by CVE-2026-104873 via langgraph-sdk (>=0.1.48, <=0.4.3)

langgraph-sdk PYPI version =0.1.48, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-104873 Source advisory: MEND:CVE-2026-104873...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873

The LangGraph Python SDK is vulnerable to an authorization bypass in versions 0.1.45 through 0.4.3 . The root cause is that resource-scoped authorization decorators (@auth.on.threads , @auth.on.assistants , and @auth.on.crons ) ignore the actions argument, registering handlers for every action on...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

PT-2026-104432

Name of the Vulnerable Software and Affected Versions LangGraph Python SDK versions 0.1.45 through 0.4.3 Description Resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on...

CVE-2026-104873: Incorrect Authorization

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

Security Bulletin: Multiple security vulnerabilities have been identified in Python packages shipped with IBM Guardium Cryptography Manager (GCM)

Summary Multiple security vulnerabilities identified in Python packages shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-48775 DESCRIPTION: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-27794 DESCRIPTION: LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in...

CLEANSTART-2026-DI87779 Security fix for GHSA-f4xh-w4cj-qxq8 applied in: py3-langgraph 1.1.10-r0, py3-langgraph-checkpoint 4.1.1-r0, py3-langgraph-prebuilt 1.1.0-r0

GHSA-f4xh-w4cj-qxq8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PK67408 Security fix for GHSA-gr75-jv2w-4656 applied in: py3-langgraph-prebuilt 1.1.0-r0

Security vulnerability affects the py3-langgraph-prebuilt package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101368

Security vulnerability affects the py3-langgraph-prebuilt package. This issue is resolved in later releases. See references for vulnerability details...