MediumVulnerabilityCVE-2026-118667updated 28 Oct 2026, 21:17 UTC
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
Fix availableOfficial, 2 sources
| Severity | MediumCVSS 4.3 of 10 |
|---|---|
| Being exploited? | UnclearNo reports either way yet |
| Fix available? | Yeslanggraph-sdk 0.4.6, langgraph 1.2.14 · since 28 Oct 2026 |
| How sure is this? | Official, 2 sourcesBacked by an official source |
Are you affected?
| Package / product | Affected versions | Fixed in |
|---|---|---|
| langgraph-sdk · pip | >= 0.4.0, < 0.4.6 | 0.4.6 |
| langgraph · pip | >= 1.2.3, < 1.2.14 | 1.2.14 |
Timeline
- 28 Oct 2026, 21:05 UTCPublicly disclosed
- 28 Oct 2026, 21:05 UTCReported by GitHub Advisory · GitHub Advisory
- 28 Oct 2026, 21:06 UTCPicked up by Zero Radar
- 28 Oct 2026, 21:17 UTCNVD reported on it · NVD
Sources 2 reports, oldest first
Official vendor, government CERT or advisory database
- LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsGitHub Advisory · 28 Oct 2026, 21:05 UTC
- CVE-2026-118667NVD · 28 Oct 2026, 21:16 UTC
Technical details
- ID
- CVE-2026-118667 · GHSA-3fx2-cqw9-xr3c
- CVSS
- 4.3 / 10
- Disclosed
- 28 Oct 2026, 21:05 UTC
- On Zero Radar
- 28 Oct 2026, 21:06 UTC (1 min after disclosure)
- Last change
- 28 Oct 2026, 21:17 UTC
This entry has not been explained yet. The text comes straight from the source. How Zero Radar works