CVE-2026-14742: Weak Hash in LangGraph Task Result Cache (CVSS 3.1)

Technical summary

The vulnerability resides in the _freeze function within libs/langgraph/langgraph/_internal/_cache.py. The function's handling of the default_cache_key parameter employs weak cryptographic hashing (CWE-327, CWE-328), which fails to provide adequate collision resistance or preimage protection. An authenticated, network-positioned attacker can manipulate inputs to the cache key derivation process, potentially recovering or predicting cached task results that should remain confidential. The attack vector is network-based but requires valid credentials (PR:L) and high attack complexity (AC:H), limiting real-world exploitability.

Business impact

Organizations using LangGraph for AI orchestration with sensitive task results cached in production environments face a confidentiality risk. If an attacker gains valid user credentials and network access, they could potentially view cached data they should not have access to—including intermediate results from language model chains, embeddings, or other sensitive processing steps. This is most concerning in multi-tenant or shared infrastructure scenarios where cache isolation is a security boundary. The low CVSS score reflects that this is a confidentiality-only impact with high attack friction, not a complete system compromise.

Affected systems

LangGraph versions up to and including 1.2.4 are affected. The vulnerability is in the core Task Result Cache module used by any LangGraph deployment. Impact depends on whether the cache stores sensitive data and whether the deployment grants multiple users or external parties credentials to access the same LangGraph instance. Open-source users running LangGraph directly, as well as applications embedding LangGraph, should assess their usage.

Exploitability

Public disclosure has occurred, and a proof-of-concept is available, raising awareness among both defenders and potential adversaries. However, practical exploitation remains difficult because the attacker must: (1) obtain valid authentication credentials, (2) understand the cache key structure and inputs, (3) perform hash collision or preimage analysis, and (4) gain network access to the LangGraph service. These cumulative requirements make opportunistic attacks unlikely, though determined adversaries with insider access or compromised credentials pose a real threat.

Remediation

Upgrade LangGraph to a version newer than 1.2.4 once a patched release is available. A pull request addressing the weak hash issue has been submitted and is awaiting acceptance, so users should monitor LangChain AI's repository and release notes for the fix. In the interim, restrict network and credential access to LangGraph instances, ensure cache storage is encrypted at rest, and consider disabling the Task Result Cache if it contains highly sensitive data.

Patch guidance

Watch the LangChain AI GitHub repository for the next stable release after 1.2.4 that includes the accepted pull request. When available, prioritize updating LangGraph in all environments, starting with production systems that cache sensitive task outputs. Verify the patch by reviewing the merged PR to confirm the _freeze function now uses a cryptographically strong hashing mechanism (e.g., SHA-256 or HMAC-based key derivation). Test thoroughly in a staging environment before production rollout.

Detection guidance

Monitor LangGraph logs for unusual cache key generation patterns or repeated failed cache lookups, which may indicate an attacker probing the cache. Implement network segmentation to limit access to LangGraph services to trusted users and systems. Review credential usage and audit logs for any suspicious authentications or cache accesses from unexpected locations. Use a software composition analysis (SCA) tool to identify LangGraph 1.2.4 or earlier in your codebase and track instances over time.

Why prioritize this

Although the CVSS score is low and exploitation is difficult, this vulnerability should not be ignored in organizations handling sensitive AI workloads. Prioritize patching if your LangGraph deployment caches confidential data, serves multiple users, or operates in a zero-trust security model where credential compromise is a realistic threat. For development-only or low-sensitivity deployments, patching can be scheduled normally.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects a confidentiality-only impact (C:L) with no integrity or availability risk, combined with high attack complexity (AC:H) and a requirement for prior authentication (PR:L). The network attack vector (AV:N) prevents the score from being even lower, but the multiple limiting factors—credentials, complexity, and lack of system-wide compromise—result in a low overall rating. This is an appropriate calibration for an insider threat or privilege-escalation scenario rather than a critical remote exploit.

Frequently asked questions