EUVD-2026-37289
GHSA-w39p-vh2g-g8g5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Path manipulation in the LangGraph Python SDK (langgraph-sdk) version 0.3.14 and earlier lets caller-supplied identifier values containing URL-special characters redirect an HTTP request to a different resource — or resource type — than the SDK call intended. When applications forward untrusted, unvalidated identifiers into SDK methods and rely on upstream URL-prefix authorization, an attacker can reach, modify, or delete resources outside their authorization scope. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but CVSS is rated 9.1 due to high confidentiality and integrity impact.
Earlier versions of this analysis (2)
Path-based authorization bypass in LangChain's langgraph-sdk (Python) versions 0.3.14 and earlier lets attacker-controlled identifier values escape their intended URL path segment, redirecting an SDK request to a different resource - or resource type - than the call site intended. Where applications forward unvalidated end-user input into SDK identifier parameters and enforce authorization by URL prefix at an upstream proxy/gateway/WAF, this enables unintended read, modification, or deletion of resources outside the caller's authorization scope. It is fixed in 0.3.15 (and langgraph 1.2.1); there is no public exploit identified at time of analysis, EPSS is low (0.22%, 12th percentile), and CISA SSVC scores exploitation as none.
Unsafe URL path construction in LangGraph Python SDK versions 0.3.14 and prior allows authenticated low-privileged users to redirect SDK HTTP requests to unintended API resources by injecting URL path-special characters into identifier parameters. The SDK builds HTTP request paths directly from caller-supplied identifiers (thread IDs, assistant IDs, run IDs) without percent-encoding or sanitization, meaning an identifier such as '../other-resource' alters the resolved path. In deployments that accept untrusted end-user input as SDK identifiers and rely on URL-prefix-based authorization at an upstream layer, an attacker can access, modify, or delete resources outside their intended authorization scope. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS score of 4.2 reflects the high attack complexity imposed by the specific deployment conditions required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because exploitation needs a non-default config (unvalidated IDs plus URL-prefix upstream authz); PR:L since the attacker is typically an authenticated/untrusted end user supplying identifiers; C:H/I:H for cross-scope read and modify/delete, A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to address a different resource (and potentially a different resource type) than the SDK method's call site indicates. In deployments where the SDK receives identifier values that originate from untrusted sources, this could result in unintended access, modification, or deletion of resources beyond the calling user's authorization scope. This issue is most consequential in deployments that forward end-user-supplied values directly into SDK identifier parameters without first validating them against an expected format (such as a UUID), and rely on URL-prefix-based authorization at an upstream layer (reverse proxy, edge gateway, WAF), where the authorization decision is made on the SDK call's intended path rather than on the final delivered request path. The issue has been fixed in version 0.3.15.
Blast Radius
ecosystem impact- 167 pypi packages depend on langgraph-sdk (7 direct, 161 indirect)
Ecosystem-wide dependent count for version 0.3.15.
Executive ViewAI
LangGraph SDK (versions 0.3.14 and earlier) contains a critical authorization bypass vulnerability enabling unauthorized access to or modification of protected resources. While no public exploit has been identified at time of analysis, organizations processing untrusted identifiers through the SDK face significant risk of data exposure and integrity compromise. Immediate patching is required to prevent unauthorized resource access.
24 hours: Identify all systems running langgraph-sdk version 0.3.14 or earlier and assess applications that process untrusted identifiers. 7 days: Upgrade langgraph-sdk to the latest patched version across all development and production environments; validate application functionality post-upgrade. 30 days: Audit identifier handling practices in applications using LangGraph SDK; implement input validation and monitoring for suspicious resource access patterns.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB