CVE-2026-118668: LangGraph Store namespace rewrite

Q: Is CVE-2026-118668 actively exploited?

No confirmed active exploitation of CVE-2026-118668 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-118668?

1. Upgrade langgraph-api to 0.15.0 or later. 2. Until you can patch, change JS/TS Store authorization handlers to reject unauthorized namespaces instead of rewriting them, or move custom auth to Python. 3. Inventory deployments for JS/TS custom auth with Store handlers that return rewritten namespaces. 4. Review Store access logs for requests whose namespace does not match the authenticated user's identity, and look for unexpected deletes or overwrites. 5. Check agent memory for tampered or foreign entries, and notify affected tenants if cross-user access is confirmed. 6. Add integration tests that confirm cross-tenant Store requests are denied.

Q: What systems are affected by CVE-2026-118668?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Agent memory stores, Multi-tenant LLM platforms, Stateful agent deployments.

Q: What is the CVSS score for CVE-2026-118668?

No CVSS score has been assigned yet.

CISO Take

langgraph-api versions 0.1.2 through 0.14.x have an authorization flaw: when JavaScript or TypeScript custom authentication Store handlers return a rewritten namespace to enforce per-user isolation, the rewrite is never applied across the runtime boundary before the Store operation runs. Any authenticated user can therefore read, overwrite, search, or delete another user's Store data, which for agent deployments often includes long-term memory, user preferences, and cached context. No CVSS or EPSS score is published yet, there is no KEV listing, and no public exploit or scanner template exists, so exploitation likelihood is unquantified. The flaw is trivial to abuse for any valid account, though, and it only affects deployments that rely on namespace rewriting in JS/TS handlers. Python custom auth and handlers that reject unauthorized namespaces instead of rewriting them are not affected. Upgrade langgraph-api to 0.15.0 and audit which tenants' Store data may have been accessed.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Moderate to high for multi-tenant deployments that use JS/TS custom auth with namespace-rewriting Store handlers, because the authorization control silently fails and users get cross-tenant access. Exploitation requires only a valid low-privilege account and no special AI/ML knowledge. Severity is not yet scored (CVSS N/A), EPSS is unavailable, and there is no known exploitation or public exploit. Single-tenant deployments, Python auth deployments, and reject-style handlers are not exposed. CWE-639 (authorization bypass through user-controlled key) and CWE-863 (incorrect authorization) describe the flaw.

How does the attack unfold?

Initial Access

The attacker authenticates with a valid low-privilege account on a LangGraph deployment that uses JS/TS custom auth.

AML.T0012

Exploitation

The attacker sends Store requests targeting another user's namespace, and the handler's namespace rewrite is never applied.

AML.T0036

Collection

The attacker reads and searches the victim's stored agent memory and data, such as preferences and cached context.

AML.T0036

Impact

The attacker overwrites or deletes the victim's entries, which corrupts agent memory or removes data.

AML.T0080.000

Initial Access

The attacker authenticates with a valid low-privilege account on a LangGraph deployment that uses JS/TS custom auth.

AML.T0012

Exploitation

The attacker sends Store requests targeting another user's namespace, and the handler's namespace rewrite is never applied.

AML.T0036

Collection

The attacker reads and searches the victim's stored agent memory and data, such as preferences and cached context.

AML.T0036

Impact

The attacker overwrites or deletes the victim's entries, which corrupts agent memory or removes data.

AML.T0080.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangGraph	pip	—	No patch
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →
LangGraph	pip	>= 0.1.2, < 0.15.0	`0.15.0`
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

6 steps

Upgrade langgraph-api to 0.15.0 or later.
Until you can patch, change JS/TS Store authorization handlers to reject unauthorized namespaces instead of rewriting them, or move custom auth to Python.
Inventory deployments for JS/TS custom auth with Store handlers that return rewritten namespaces.
Review Store access logs for requests whose namespace does not match the authenticated user's identity, and look for unexpected deletes or overwrites.
Check agent memory for tampered or foreign entries, and notify affected tenants if cross-user access is confirmed.
Add integration tests that confirm cross-tenant Store requests are denied.

How is it classified?

Auth BypassData LeakageFrameworkAgentAPIAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0080.000- Memory AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to Previously Unknown Risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118668?

langgraph-api versions 0.1.2 through 0.14.x have an authorization flaw: when JavaScript or TypeScript custom authentication Store handlers return a rewritten namespace to enforce per-user isolation, the rewrite is never applied across the runtime boundary before the Store operation runs. Any authenticated user can therefore read, overwrite, search, or delete another user's Store data, which for agent deployments often includes long-term memory, user preferences, and cached context. No CVSS or EPSS score is published yet, there is no KEV listing, and no public exploit or scanner template exists, so exploitation likelihood is unquantified. The flaw is trivial to abuse for any valid account, though, and it only affects deployments that rely on namespace rewriting in JS/TS handlers. Python custom auth and handlers that reject unauthorized namespaces instead of rewriting them are not affected. Upgrade langgraph-api to 0.15.0 and audit which tenants' Store data may have been accessed.

Is CVE-2026-118668 actively exploited?

No confirmed active exploitation of CVE-2026-118668 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118668?

1. Upgrade langgraph-api to 0.15.0 or later. 2. Until you can patch, change JS/TS Store authorization handlers to reject unauthorized namespaces instead of rewriting them, or move custom auth to Python. 3. Inventory deployments for JS/TS custom auth with Store handlers that return rewritten namespaces. 4. Review Store access logs for requests whose namespace does not match the authenticated user's identity, and look for unexpected deletes or overwrites. 5. Check agent memory for tampered or foreign entries, and notify affected tenants if cross-user access is confirmed. 6. Add integration tests that confirm cross-tenant Store requests are denied.

What systems are affected by CVE-2026-118668?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Agent memory stores, Multi-tenant LLM platforms, Stateful agent deployments.

What is the CVSS score for CVE-2026-118668?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Agent frameworksAgent memory storesMulti-tenant LLM platformsStateful agent deployments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0080.000Memory

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user's Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0.

Exploitation Scenario

An attacker registers a legitimate account on a SaaS product built on a self-hosted LangGraph deployment, whose JS auth handler rewrites Store namespaces to the caller's user ID. The attacker calls the Store API with another user's namespace, such as one containing their ID. The rewrite is not applied, so the request runs against the victim's namespace. The attacker enumerates and reads stored memories, which may contain PII, preferences, or business data. They can also overwrite entries with malicious instructions that the victim's agent later loads as trusted memory, or delete the data.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect AuthorizationPrimary CWE-639Authorization Bypass Through User-Controlled Key CWE-863Incorrect Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.