CVE-2026-118668

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...

CVE-2026-118668 LangGraph JavaScript custom authentication may permit cross-user Store access

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operatio...

CVE-2026-118668

The langgraph-api library (versions 0.1.2 through 0.15.0 ) contains a vulnerability where JavaScript or TypeScript custom authentication handlers can return a rewritten namespace that fails to carry across the runtime boundary. This allows an authenticated user to bypass isolation and access anot...