CVE-2026-115885: LangGraph deploy --verbose leaks

Q: Is CVE-2026-115885 actively exploited?

No confirmed active exploitation of CVE-2026-115885 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115885?

1) Upgrade the LangGraph CLI (langgraph-cli) to 0.4.32 or later. 2) Remove --verbose from langgraph deploy in CI/CD pipelines until upgraded. 3) Identify CI runs and terminal recordings from verbose deploys on 0.4.15-0.4.31 and restrict or purge those logs; tokens expire within 12 hours, so only recent logs pose live risk. 4) Where a log was exposed within the last 12 hours, revoke or rotate the registry credentials if possible and audit the image repository for unexpected pushes, tags or digest changes. 5) Enable CI log masking for registry tokens and limit log read access. 6) Detection: search logs for docker login invocations with token material, and monitor registry audit logs for pulls or pushes from unfamiliar IPs or identities. 7) Verify image digests/signatures before promoting images.

Q: What systems are affected by CVE-2026-115885?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM application deployment pipelines, CI/CD for AI agents, Container registries for AI deployments.

Q: What is the CVSS score for CVE-2026-115885?

CVE-2026-115885 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.11%.

CISO Take

The LangGraph CLI (versions 0.4.15 through 0.4.31) prints the temporary registry push token to output when `langgraph deploy --verbose` runs, because the subprocess helper echoes the stdin passed to `docker login --password-stdin`. Anyone who can read the resulting CI logs or terminal recordings within the token's 12-hour lifetime can pull deployment images or push images to that deployment's image repository. This is a low-to-moderate, conditional exposure: there is no CVSS score, no EPSS data, no KEV listing, no public exploit and no Nuclei template, and the token alone cannot make a deployment run a pushed image, which limits the blast radius. The main risks are image content disclosure (embedded code, config or baked-in secrets) and image tampering that could matter if another path later promotes the pushed image. Upgrade the CLI to 0.4.32 or later, stop using --verbose in CI, and review who can access past CI logs and recordings from verbose deploys.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Overall risk is LOW to MEDIUM and conditional. Exploitation requires access to logs or recordings that contain the token (CI log readers, shared terminal sessions, screen recordings, log aggregators) and use within the 12-hour expiry. Only deployments run with --verbose are affected. Remote image builds are not affected. The token does not allow updating a deployment to run a pushed image, which limits direct code execution. No CVSS, EPSS, KEV or public exploit data is available, so the severity is assessed qualitatively from the advisory text. Confidence: HIGH on the technical description (vendor advisory and fix commit), LOW on exploitation likelihood.

How does the attack unfold?

Credential Exposure

A verbose `langgraph deploy` run prints the temporary registry push token into CI logs or terminal recordings.

AML.T0055

Token Harvesting

An attacker with read access to the logs or recordings copies the token within its 12-hour validity window.

AML.T0091.000

Registry Access

The attacker authenticates to the container registry and pulls deployment images or pushes images to the repository.

AML.T0010.004

Impact

Proprietary agent code and embedded secrets are disclosed, and a tampered image may be staged for later supply chain abuse.

Credential Exposure

A verbose `langgraph deploy` run prints the temporary registry push token into CI logs or terminal recordings.

AML.T0055

Token Harvesting

An attacker with read access to the logs or recordings copies the token within its 12-hour validity window.

AML.T0091.000

Registry Access

The attacker authenticates to the container registry and pulls deployment images or pushes images to the repository.

AML.T0010.004

Impact

Proprietary agent code and embedded secrets are disclosed, and a tampered image may be staged for later supply chain abuse.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangGraph	pip	—	No patch
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →
LangGraph	pip	>= 0.4.15, <= 0.4.31	`0.4.32`
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACHigh

PRLow

UIRequired

SUnchanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade the LangGraph CLI (langgraph-cli) to 0.4.32 or later. 2) Remove --verbose from langgraph deploy in CI/CD pipelines until upgraded. 3) Identify CI runs and terminal recordings from verbose deploys on 0.4.15-0.4.31 and restrict or purge those logs; tokens expire within 12 hours, so only recent logs pose live risk. 4) Where a log was exposed within the last 12 hours, revoke or rotate the registry credentials if possible and audit the image repository for unexpected pushes, tags or digest changes. 5) Enable CI log masking for registry tokens and limit log read access. 6) Detection: search logs for docker login invocations with token material, and monitor registry audit logs for pulls or pushes from unfamiliar IPs or identities. 7) Verify image digests/signatures before promoting images.

How is it classified?

Data LeakageSupply ChainFrameworkAgentAML.T0010.004- Container Registry AML.T0055- Unsecured Credentials AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115885?

The LangGraph CLI (versions 0.4.15 through 0.4.31) prints the temporary registry push token to output when `langgraph deploy --verbose` runs, because the subprocess helper echoes the stdin passed to `docker login --password-stdin`. Anyone who can read the resulting CI logs or terminal recordings within the token's 12-hour lifetime can pull deployment images or push images to that deployment's image repository. This is a low-to-moderate, conditional exposure: there is no CVSS score, no EPSS data, no KEV listing, no public exploit and no Nuclei template, and the token alone cannot make a deployment run a pushed image, which limits the blast radius. The main risks are image content disclosure (embedded code, config or baked-in secrets) and image tampering that could matter if another path later promotes the pushed image. Upgrade the CLI to 0.4.32 or later, stop using --verbose in CI, and review who can access past CI logs and recordings from verbose deploys.

Is CVE-2026-115885 actively exploited?

No confirmed active exploitation of CVE-2026-115885 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115885?

1) Upgrade the LangGraph CLI (langgraph-cli) to 0.4.32 or later. 2) Remove --verbose from langgraph deploy in CI/CD pipelines until upgraded. 3) Identify CI runs and terminal recordings from verbose deploys on 0.4.15-0.4.31 and restrict or purge those logs; tokens expire within 12 hours, so only recent logs pose live risk. 4) Where a log was exposed within the last 12 hours, revoke or rotate the registry credentials if possible and audit the image repository for unexpected pushes, tags or digest changes. 5) Enable CI log masking for registry tokens and limit log read access. 6) Detection: search logs for docker login invocations with token material, and monitor registry audit logs for pulls or pushes from unfamiliar IPs or identities. 7) Verify image digests/signatures before promoting images.

What systems are affected by CVE-2026-115885?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM application deployment pipelines, CI/CD for AI agents, Container registries for AI deployments.

What is the CVSS score for CVE-2026-115885?

CVE-2026-115885 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.11%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM application deployment pipelinesCI/CD for AI agentsContainer registries for AI deployments

MITRE ATLAS Techniques

AML.T0010.004Container Registry

AML.T0055Unsecured Credentials

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.

Exploitation Scenario

A contractor or compromised account has read access to a CI system where a team runs `langgraph deploy --verbose` for its production agent. The attacker opens the build log, copies the temporary registry push token printed by the CLI, and within 12 hours authenticates to the container registry. They pull the deployment image to extract proprietary agent code, prompts and any embedded credentials, and may push a tampered image to the deployment's repository to set up a later supply chain compromise if the image gets promoted by another process.

Weaknesses (CWE)

CWE-532Insertion of Sensitive Information into Log FilePrimary CWE-532Insertion of Sensitive Information into Log FilePrimary CWE-532Insertion of Sensitive Information into Log File

CWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.

[Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
[Distribution] Remove debug log files before deploying the application into production.

Source: MITRE CWE corpus.