CVE-2026-118667

The LangGraph Python SDK is vulnerable to a path traversal issue in its v3 streaming client (synchronous and asynchronous) across langgraph-sdk versions 0.4.0 through 0.4.5 and langgraph versions 1.2.3 through 1.2.14. The get_tree and _fetch_state helpers fail to use _quote_path_param when interp...

CVE-2026-118667 LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the...