ROOT-APP-PYPI-CVE-2026-55253 CVE-2026-55253 in langgraph-store-mongodb - Patched by Root

Root has patched CVE-2026-55253 in the langgraph-store-mongodb package for Root:PyPI. Multiple fixed versions available...

EUVD-2026-77674

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-55253 LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

dev-tools-eagle (>=0.9.0, <=0.9.4) potentially affected by CVE-2026-55253 via langgraph-store-mongodb (0.1.1)

langgraph-store-mongodb PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-store-mongodb and may be impacted: - dev-tools-eagle =0.9.0, =0.9.4 Source cves: CVE-2026-55253 Source advisory: MEND:CVE-2026-55253...

django-ai-support (0.1.11), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-55253 via langgraph-checkpoint-mongodb (>=0.2.1, <=0.3.1)

langgraph-checkpoint-mongodb PYPI version =0.2.1, =0.1.0, =0.1.1 Source cves: CVE-2026-55253 Source advisory: MEND:CVE-2026-55253...

CVE-2026-55235

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55236

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-55235

langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

EUVD-2026-77585

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55235 via langgraph-api (>=0.0.22, <=0.9.1)

langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55235 Source advisory: MEND:CVE-2026-55235...

CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55236 via langgraph-api (>=0.0.22, <=0.9.1)

langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55236 Source advisory: MEND:CVE-2026-55236...

CVE-2026-55236

CVE-2026-55236 is an incomplete authorization flaw in langgraph-api (the LangGraph Server runtime) prior to version 0.10.0. The run-creation path dispatched the assistants.search authorization event with an incomplete value instead of assistants.read , so in deployments whose custom resource hand...

EUVD-2026-77583

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...