PYSEC-2026-4240 LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

Authorization Bypass

langgraphsdk is vulnerable to an authorization bypass. The vulnerability is due to the @auth.on.threads, @auth.on.assistants, and @auth.on.crons decorators ignoring the specified actions argument, which allows an authenticated attacker to bypass fallback permission or ownership checks and read,...

LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

EUVD-2026-91794

LangGraph SDK custom auth silently ignores actions= on resource decorators...

GHSA-FVWW-7H3R-VFHP LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

CVE-2026-104873

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

PT-2026-104432

Name of the Vulnerable Software and Affected Versions LangGraph Python SDK versions 0.1.45 through 0.4.3 Description Resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on...