langgraph-api: Authorization bypass allows cross-user access to Store data
Summary
langgraph-api, the server runtime of LangGraph, has an authorization flaw in deployments that use JavaScript or TypeScript custom authentication with Store authorization handlers. A namespace rewritten by the handler is not carried across the runtime boundary and not applied before the Store operation. An authenticated user can then read, overwrite, search or delete another user's Store data, but only if the deployment relies on namespace rewriting for isolation.
Affected
- langgraph-api >= 0.1.2 and < 0.15.0
- Only JavaScript or TypeScript custom authentication with namespace-rewriting Store handlers
- Python custom authentication and handlers that reject unauthorized namespaces are not affected
Fixed in
- Upgrade to langgraph-api 0.15.0 or later
Workaround
- Change JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces instead of rewriting them
- Apply this change to every Store action exposed by the deployment
Exploitation
- No public exploit or proof of concept found in the sources reviewed
- OffSeq lists it as not known to be exploited (as of 28 Oct 2026)
- CISA SSVC: exploitation none, not automatable, total technical impact
- Presence in the CISA KEV catalog: unknown, to be checked
Our recommendation
- Identify LangGraph deployments and their langgraph-api version
- Upgrade to langgraph-api 0.15.0 or later
- If upgrading is delayed, apply the handler change from the workaround section
- Review Store data for signs of cross-user access and monitor Store operations
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4hm6-w6qq-w73v github.com
- OSV: GHSA-4hm6-w6qq-w73v osv.dev
- GitLab Advisory Database: CVE-2026-118668 advisories.gitlab.com
- LangChain documentation: Store authorization docs.langchain.com
- VulDB: CVE-2026-118668 vuldb.com
- OffSeq Radar: CVE-2026-118668 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:52.
Original description (NVD)
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user's Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.