Am I affected by LangGraph JavaScript custom authentication may permit cross-user Store access? What should I do?
LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler.
Affected: langgraph-api >= 0.1.2, < 0.15.0. Fixed in: 0.15.0. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-118668-langgraph-api (opens external site)
1 answer
Am I affected? Affected: langgraph-api >= 0.1.2, < 0.15.0. Fixed in: 0.15.0.
- Check your version: run
pip show langgraph-api. Versions >= 0.1.2, < 0.15.0 of langgraph-api are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "langgraph-api>=0.15.0"(first patched version 0.15.0). - Users should upgrade to
langgraph-api>=0.15.0. - Deployments that cannot upgrade immediately should change JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces rather than relying on namespace rewriting.
- This workaround must be applied to every Store action exposed by the deployment.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-4hm6-w6qq-w73v (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-118668-langgraph-api (opens external site)
Did this work for you?- Check your version: run