LangGraph API CVE-2026-118668

Exploitation requires ALL of: a vulnerable langgraph-api version (>=0.1.2, <0.15.0); the deployment running JavaScript or TypeScript custom authentication (NOT Python); the Store authorization handler relying on REWRITING the requested namespace to isolate users (handlers that reject unauthorized namespaces are not affected); an attacker able to authenticate as an ordinary user; and multiple users' data stored through the affected authorization path. Limiting factors that reduce real-world exposure: authentication as a valid user is required (PR:L), Python custom authentication is entirely unaffected, and the vulnerable namespace-rewriting pattern is a specific implementation choice rather than a guaranteed default. No administrator privileges, user interaction, race condition, or mitigation bypass is required per the advisory.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.6 High) describes a network-reachable, low-complexity authorization flaw (CWE-639/CWE-863) requiring only ordinary authenticated-user privileges (PR:L) and no user interaction, with high confidentiality and integrity impact on other users' Store data. However, exploitability is strongly gated by deployment configuration: the GitHub Security Advisory confirms the flaw only manifests when langgraph-api runs JavaScript/TypeScript custom authentication AND the Store authorization handler isolates users by REWRITING the requested namespace rather than rejecting it. Python handlers and JS/TS handlers that reject unauthorized namespaces are explicitly unaffected. No EPSS score was supplied, this CVE is not on CISA KEV, and no public exploit or PoC was provided (only the vendor advisory is referenced). The priority signal provided is 'this_week' rather than act_now/emergency. Net assessment: a genuinely high-severity authorization bug for the subset of deployments matching the vulnerable pattern, but with no evidence of active exploitation and a materially narrower real-world footprint than the raw 8.6 suggests - the score reflects impact on an affected deployment, not the likelihood that any given deployment is affected.

In a LangGraph deployment that uses JavaScript/TypeScript custom authentication and enforces per-user Store isolation by rewriting namespaces, an attacker authenticates as an ordinary user and issues Store operations (read, search, put/overwrite, delete). Because the namespace rewrite returned by the JS/TS authorization handler is not carried across the runtime boundary and applied before the Store operation, the attacker's original (unauthorized) namespace is used, granting access to another user's data. No public PoC or exploit code was provided; only the vendor advisory is referenced.