LangGraph CLI Prints The Registry Push Token In `langgraph Deploy --verbose` Output

Summary "langgraph deploy --verbose" printed the temporary registry push token that the CLI uses to log Docker in to the deployment's image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired. Details When Docker is available, "langgraph deplo...

swe-forge (>=0.2.2, <=0.2.3) potentially affected by CVE-2026-115885 via langgraph-cli (0.4.27)

langgraph-cli PYPI version 0.4.27 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-cli and may be impacted: - swe-forge =0.2.2, =0.2.3 Source cves: CVE-2026-115885 Source advisory: GHSA-8PRR-F582-JQQ3...

GHSA-8PRR-F582-JQQ3 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Summary langgraph deploy --verbose printed the temporary registry push token that the CLI uses to log Docker in to the deployment's image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired. Details When Docker is available, langgraph deploy...

EUVD-2026-109183

LangGraph CLI prints the registry push token in langgraph deploy --verbose output...

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Summary langgraph deploy --verbose printed the temporary registry push token that the CLI uses to log Docker in to the deployment's image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired. Details When Docker is available, langgraph deploy...

swe-forge (>=0.2.2, <=0.2.3) potentially affected by CVE-2026-115885 via langgraph-cli (0.4.27)

langgraph-cli PYPI version 0.4.27 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-cli and may be impacted: - swe-forge =0.2.2, =0.2.3 Source cves: CVE-2026-115885 Source advisory: OSV:GHSA-8PRR-F582-JQQ3...

Insertion of Sensitive Information into Log File

Overview langgraph-cli is a CLI for interacting with LangGraph API Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the --image-uri flag in langgraph deploy, where the CLI pushes a built Docker image to a caller-supplied registry URI using...

swe-forge (>=0.2.2, <=0.2.3) potentially affected by CVE-2026-115885 via langgraph-cli (0.4.27)

langgraph-cli PYPI version 0.4.27 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-cli and may be impacted: - swe-forge =0.2.2, =0.2.3 Source cves: CVE-2026-115885 Source advisory: SNYK:PYTHON-LANGGRAPHCLI-21663377...

CVE-2026-115885

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

CVE-2026-115885

The LangGraph CLI (versions 0.4.15 through 0.4.32 ) contains a vulnerability where the langgraph deploy --verbose command prints a temporary registry push token to the standard output. This occurs because the CLI's subprocess helper prints command input in verbose mode while passing the token to ...

CVE-2026-115885

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

CVE-2026-115885 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

CVE-2026-115885 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

swe-forge (>=0.2.2, <=0.2.3) potentially affected by CVE-2026-115885 via langgraph-cli (0.4.27)

langgraph-cli PYPI version 0.4.27 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-cli and may be impacted: - swe-forge =0.2.2, =0.2.3 Source cves: CVE-2026-115885 Source advisory: MEND:CVE-2026-115885...

CVE-2026-115885 LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

PT-2026-122232

Name of the Vulnerable Software and Affected Versions LangGraph CLI versions 0.4.15 through 0.4.31 Description When using the langgraph deploy command with the --verbose flag, the CLI subprocess helper prints command input to the logs. This behavior causes a temporary registry push token, passed ...