LangGraph SDK EUVD-2026-112474

Exploitation requires all of: (1) use of langgraph-sdk 0.4.0-0.4.5 (the v3 stream module does not exist in 0.3.x), or langgraph 1.2.3-1.2.13 using RemoteGraph v3 streaming against such an SDK; (2) the application must pass attacker-controlled text directly as a streaming thread_id or assistant_id (for RemoteGraph, via config['configurable']['thread_id']); and (3) the flaw is reached through the v3 get_tree (assistant_id) or _fetch_state/_run_lifecycle_watcher (thread_id) helpers. Limiting factors: impact is read-only (GET, no write), confined to paths on the already-configured and authenticated server; assistant_id controls only the path while thread_id can also influence the query string; the hosted LangGraph Platform is not exposed; and applications that do not forward untrusted identifiers are unaffected.

This is a genuine but modest-severity path-handling flaw, not an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) and CWE-22 are consistent with the advisory: unencoded thread_id/assistant_id values interpolated into authenticated GET paths allow relative segments to redirect a request to another readable path on the same configured server, yielding limited confidentiality impact only (C:L, I:N, A:N - GET-only, no write primitive per the GHSA). No KEV listing, no EPSS score, and no exploit reference were supplied - the only code links are the fix PR/commit and the advisory, so this is no public exploit identified at time of analysis. The vuln.today decision label is this_month, aligning with the low-to-medium signals rather than emergency. The key caveat is PR:L: the 'privilege' here is really the SDK client's own configured authentication headers, while the triggering input (the malicious identifier) comes from an application-exposed attacker; the flaw only manifests if the application passes attacker-controlled text as a streaming thread_id or assistant_id, so real-world exposure depends on application design, not solely on the CVSS metrics. The managed LangGraph Platform is explicitly not exposed.

An application built on langgraph/langgraph-sdk uses RemoteGraph v3 streaming and forwards untrusted user input as a thread_id or assistant_id. An attacker submits a value such as '../assistants/a/graph#' so HTTP path normalization collapses the dot-segments, redirecting the SDK's authenticated GET to a different readable endpoint (via thread_id the attacker can also control the query string, e.g. /store/items?namespace=...&key=...) and causing that response to be returned to the application. No public exploit code was supplied; only the vendor fix and tests are referenced.