GHSA-3FX2-CQW9-XR3C LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

Summary The LangGraph Python SDK v3 streaming client interpolates caller-supplied threadid and assistantid values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on...

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

Summary The LangGraph Python SDK v3 streaming client interpolates caller-supplied threadid and assistantid values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on...

CVE-2026-118667 LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the...

CVE-2026-118667

The LangGraph Python SDK is vulnerable to a path traversal issue in its v3 streaming client (synchronous and asynchronous) across langgraph-sdk versions 0.4.0 through 0.4.5 and langgraph versions 1.2.3 through 1.2.14. The get_tree and _fetch_state helpers fail to use _quote_path_param when interp...