34 matches found
CVE-2026-55235
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55236
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...
CVE-2026-55235
langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...
EUVD-2026-77585
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55235
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55235 via langgraph-api (>=0.0.22, <=0.9.1)
langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55235 Source advisory: MEND:CVE-2026-55235...
CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...
CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...
agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55236 via langgraph-api (>=0.0.22, <=0.9.1)
langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55236 Source advisory: MEND:CVE-2026-55236...
EUVD-2026-77583
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...
CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...
CVE-2026-55236
CVE-2026-55236 is an incomplete authorization flaw in langgraph-api (the LangGraph Server runtime) prior to version 0.10.0. The run-creation path dispatched the assistants.search authorization event with an incomplete value instead of assistants.read , so in deployments whose custom resource hand...
CVE-2026-55235: Improper Authentication
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
CVE-2026-55236: Improper Authorization
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...
PYSEC-2026-3857 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...
PYSEC-2026-3858 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...
agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55235 via langgraph-api (>=0.0.22, <=0.9.1)
langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55235 Source advisory: OSV:PYSEC-2026-3857...