CVE-2026-118667: LangGraph SDK: path traversal in v3 stream helpers

Q: Is CVE-2026-118667 actively exploited?

No confirmed active exploitation of CVE-2026-118667 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-118667?

1) Upgrade langgraph-sdk to 0.4.6 or later and langgraph to 1.2.14 or later. 2) Inventory services using RemoteGraph or the SDK with pip list and dependency scanning (SCA) for affected version ranges. 3) As a workaround, strictly validate assistant_id and thread_id as UUIDs or an allowlisted format and reject values containing '/', '..', '?', '#', or percent-encoded equivalents before calling the SDK. 4) Use least-privilege API credentials for the SDK client and enforce thread and assistant ownership checks server-side on the LangGraph API. 5) Detect by reviewing LangGraph server and reverse-proxy logs for GET requests with normalized or unexpected paths, or IDs containing traversal sequences.

Q: What systems are affected by CVE-2026-118667?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-tenant LLM applications, RemoteGraph / LangGraph API server deployments, Stateful agent orchestration.

Q: What is the CVSS score for CVE-2026-118667?

CVE-2026-118667 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.39%.

GHSA-3fx2-cqw9-xr3cMEDIUM

Published October 28, 2026

CISO Take

LangGraph's Python SDK builds authenticated GET request paths from caller-supplied assistant_id and thread_id values without escaping them, so relative path segments such as ../ can redirect the request to a different readable endpoint on the configured LangGraph server while the client's credentials are still attached. Exposure is narrow: the CVSS score is 4.3 (medium, confidentiality-only), there is no CISA KEV listing, no public exploit, no Nuclei template, and no EPSS score yet. The issue only matters where an application passes untrusted or user-influenced IDs into RemoteGraph v3 streaming or the SDK's get_tree and _fetch_state helpers, for example a multi-tenant app proxying end-user input. Upgrade to langgraph-sdk 0.4.6 or langgraph 1.2.14, and until then validate that IDs are UUIDs before they reach the SDK.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Low-to-medium risk. The attack is network-reachable, low complexity, and needs low privileges with no user interaction, but impact is limited to reading data (C:L) with no integrity or availability effect. Real-world risk depends on whether the application forwards attacker-controlled identifiers to the SDK. The request is made with the application's own credentials, so the traversal can reach resources that the calling user should not see but the service account can. No active exploitation, public PoC, or scanner coverage has been observed, and downstream dependent counts are unknown.

How does the attack unfold?

Initial Access

An authenticated low-privilege user supplies a crafted assistant_id or thread_id containing relative path segments to an application using the LangGraph SDK.

AML.T0049

Exploitation

The SDK interpolates the unescaped value into the GET path, which normalizes to a different endpoint while keeping the authentication headers.

AML.T0049

Collection

The LangGraph server returns data from the unintended resource, such as another thread's state, to the attacker.

AML.T0036

Impact

Conversation history, agent state, and tool outputs belonging to other users or assistants are disclosed.

AML.T0057

Initial Access

An authenticated low-privilege user supplies a crafted assistant_id or thread_id containing relative path segments to an application using the LangGraph SDK.

AML.T0049

Exploitation

The SDK interpolates the unescaped value into the GET path, which normalizes to a different endpoint while keeping the authentication headers.

AML.T0049

Collection

The LangGraph server returns data from the unintended resource, such as another thread's state, to the attacker.

AML.T0036

Impact

Conversation history, agent state, and tool outputs belonging to other users or assistants are disclosed.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangGraph	pip	>= 1.2.3, < 1.2.14	`1.2.14`
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →
LangGraph	pip	>= 0.4.0, < 0.4.6	`0.4.6`
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade langgraph-sdk to 0.4.6 or later and langgraph to 1.2.14 or later. 2) Inventory services using RemoteGraph or the SDK with pip list and dependency scanning (SCA) for affected version ranges. 3) As a workaround, strictly validate assistant_id and thread_id as UUIDs or an allowlisted format and reject values containing '/', '..', '?', '#', or percent-encoded equivalents before calling the SDK. 4) Use least-privilege API credentials for the SDK client and enforce thread and assistant ownership checks server-side on the LangGraph API. 5) Detect by reviewing LangGraph server and reverse-proxy logs for GET requests with normalized or unexpected paths, or IDs containing traversal sequences.

How is it classified?

Data LeakageAuth BypassFrameworkAgentAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118667?

Is CVE-2026-118667 actively exploited?

No confirmed active exploitation of CVE-2026-118667 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118667?

1) Upgrade langgraph-sdk to 0.4.6 or later and langgraph to 1.2.14 or later. 2) Inventory services using RemoteGraph or the SDK with pip list and dependency scanning (SCA) for affected version ranges. 3) As a workaround, strictly validate assistant_id and thread_id as UUIDs or an allowlisted format and reject values containing '/', '..', '?', '#', or percent-encoded equivalents before calling the SDK. 4) Use least-privilege API credentials for the SDK client and enforce thread and assistant ownership checks server-side on the LangGraph API. 5) Detect by reviewing LangGraph server and reverse-proxy logs for GET requests with normalized or unexpected paths, or IDs containing traversal sequences.

What systems are affected by CVE-2026-118667?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-tenant LLM applications, RemoteGraph / LangGraph API server deployments, Stateful agent orchestration.

What is the CVSS score for CVE-2026-118667?

CVE-2026-118667 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-tenant LLM applicationsRemoteGraph / LangGraph API server deploymentsStateful agent orchestration

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.

Exploitation Scenario

A SaaS application exposes a chat endpoint that accepts a thread_id from the browser and uses RemoteGraph v3 streaming to fetch thread state from an internal LangGraph server using a shared service API key. An authenticated low-privilege user submits a thread_id such as '../../threads/<victim-thread-id>/state'. The SDK interpolates it unescaped, the path normalizes to another tenant's thread endpoint, and the server returns that thread's state under the service credentials. The attacker repeats this to harvest other users' conversation data.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.