LangGraph CLI CVE-2026-115885

Exploitation requires a very specific chain: the operator must run 'langgraph deploy --verbose' with a locally available Docker daemon (so the CLI builds the image locally and performs 'docker login --password-stdin' with a LangSmith-issued push token), AND the resulting verbose output must be retained or shared where the attacker can read it (CI logs, terminal recordings), AND the attacker must use the token before its maximum 12-hour expiration. Explicitly NOT affected: deployments run without --verbose, and deployments that build the image remotely - neither ever prints the token. Limiting factors: the token is short-lived (≤12h), scoped only to that single deployment's image repository, and a pushed image cannot be made to run unless the deployment is separately updated via a LangSmith API key with access to it.

This is a genuinely low-to-medium real-world risk despite being a confirmed information-disclosure flaw. The CVSS 4.0 base score is only 4.1, and the vector reinforces a narrow threat: AV:L (the secret surfaces in local CI logs/terminal output rather than a network-facing endpoint), AT:P (a specific attack requirement - the operator must have run the vulnerable mode and an attacker must act inside the token window), PR:L (some access to the deployment/logs is needed), and UI:P (an operator must have invoked the vulnerable command). Impact is limited to confidentiality (VC:H, VI:N, VA:N). No EPSS score was provided and the issue is NOT in CISA KEV, so there is no exploitation-probability or active-exploitation signal pushing this up. No public exploit code was supplied - the four references are the GHSA advisory, the fix PR, the fix commit, and the release tag, i.e. remediation artifacts, not a PoC. The vuln.today priority label is 'this_month', consistent with a patch-on-normal-cadence item rather than an emergency. The signals are mutually consistent (low score, no KEV, no EPSS, remediation-only references, non-urgent decision label); none conflict. The dominant risk reducers are that the leaked token is short-lived (max 12 hours), scoped only to that one deployment's image repository, and cannot by itself cause a pushed image to execute (that requires a separate LangSmith API key).

A developer runs 'langgraph deploy --verbose' with Docker available in a CI pipeline using an affected CLI version (0.4.15-0.4.31); the temporary registry push token the CLI feeds to 'docker login --password-stdin' is printed into the verbose CI output. Anyone with read access to those retained CI logs or a terminal recording can copy the token within its 12-hour lifetime and authenticate to that deployment's image repository to pull its images or push new ones. No public exploit code was identified; exploitation is straightforward log-reading and requires no special tooling.