LangGraph EUVD-2026-41747

Exploitation requires a valid low-privilege authenticated session on the target LangGraph deployment running version 1.2.4 or earlier (CVSS PR:L confirmed). The attacker must have the ability to submit tasks that interact with the Task Result Cache component and influence the default_cache_key argument passed to the _freeze function. Attack complexity is rated High (AC:H), meaning reliable hash collision is not trivially achievable and requires deliberate engineering of inputs. No non-default configuration is stated as a prerequisite - any deployment with task caching enabled and multi-user access is potentially in scope. Exploitation is strictly bounded to low confidentiality impact: an attacker cannot modify cached results (VI:N) or cause denial of service (VA:N), and there is no scope change to subsequent systems (SC/SI/SA all N).

Real-world risk is low despite the existence of a public proof-of-concept. The CVSS 4.0 vector AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N confirms three distinct risk-reducing factors: authentication is required (PR:L eliminates unauthenticated mass exploitation), attack complexity is high (AC:H - collision engineering is non-trivial), and impact is bounded to low confidentiality disclosure only with no integrity or availability dimensions. The E:P modifier in the provided vector acknowledges the POC, but the base score of 2.3 appropriately reflects constrained exploitability. No EPSS data was provided; KEV status is absent, meaning CISA has not observed active exploitation. The patch exists only as an unmerged pull request (PR #8069), so no vendor-released fixed version is confirmed yet. This is a monitoring priority, not an emergency response item, for most organizations.

A low-privilege authenticated user on a shared LangGraph deployment crafts task inputs specifically engineered to produce a default_cache_key that collides with a hash value corresponding to another user's cached task result. When the cache lookup resolves the collision, the attacker receives output data from the other task, potentially exposing sensitive intermediate reasoning, tool outputs, or agent memory. A public proof-of-concept detailing this collision approach is available at https://github.com/langchain-ai/langgraph/issues/8009, though the high attack complexity (AC:H) means reliable exploitation requires significant pre-computation or trial-and-error.