LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Summary langgraph deploy --verbose printed the temporary registry push token that the CLI uses to log Docker in to the deployment's image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired. Details When Docker is available, langgraph deploy...

CVE-2026-115885 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

CVE-2026-115885 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

CVE-2026-115885

The LangGraph CLI (versions 0.4.15 through 0.4.32 ) contains a vulnerability where the langgraph deploy --verbose command prints a temporary registry push token to the standard output. This occurs because the CLI's subprocess helper prints command input in verbose mode while passing the token to ...