CVE-2026-48776: LangGraph SDK Path Traversal & Authorization Bypass

Technical summary

CVE-2026-48776 is a path traversal vulnerability (CWE-22) combined with an authorization bypass issue (CWE-863) in LangGraph Python SDK. The SDK constructs HTTP request paths by directly interpolating user-supplied identifier values without URL encoding or validation. Special characters in these identifiers—such as slashes, dots, or encoded sequences—can alter the request path structure, causing the HTTP request to target a different resource endpoint than intended by the SDK caller. This is particularly problematic in multi-tenant or role-based access control environments where upstream authorization layers make access decisions based on the initial request path rather than inspecting the final resolved endpoint. The vulnerability requires authentication (PR:L) and involves high complexity to exploit reliably (AC:H), limiting the attack surface but maintaining real risk in vulnerable deployments.

Business impact

Organizations using LangGraph SDK in production face potential unauthorized data access or modification depending on deployment architecture. If your infrastructure relies on reverse proxies, API gateways, or WAF solutions to enforce access control based on URL path patterns, this vulnerability could allow authenticated users to circumvent those controls. The impact ranges from information disclosure to unintended resource modification. The risk is highest in multi-user SaaS deployments or internal platforms where LangGraph manages sensitive assistant configurations, thread data, or user-specific resources. Remediation is straightforward (upgrade to 0.3.15), making this a manageable but urgent priority for affected deployments.

Affected systems

LangGraph Python SDK versions 0.3.14 and earlier are affected. The vulnerability applies to any Python application using the SDK to communicate with LangGraph API servers, particularly those accepting identifier values from external sources (API parameters, databases, user input). Deployments forwarding end-user identifiers directly to SDK methods without validation are at highest risk. Fixed in version 0.3.15.

Exploitability

Exploitation requires valid authentication credentials (logged-in user), making this an insider-risk or compromised-account scenario. An attacker must understand the target resource structure and craft identifiers containing path traversal characters that the SDK will then embed into HTTP requests. The complexity is elevated (AC:H) because successful exploitation depends on specific deployment architectures where authorization is enforced at the URL-path level upstream of the application. This is not remotely exploitable by unauthenticated actors and is not known to be actively exploited in the wild (not on CISA KEV list).

Remediation

Upgrade LangGraph Python SDK to version 0.3.15 or later, which implements safe URL path construction through proper identifier sanitization and encoding. Organizations should also audit deployments to identify whether identifier values originate from untrusted sources and are passed directly to SDK methods. Where feasible, implement input validation on identifiers (e.g., enforce UUID format) at the application layer before they reach the SDK. Consider shifting authorization enforcement from URL-prefix-based controls to application-aware access control if currently relying on gateway-level path matching.

Patch guidance

Update the LangGraph SDK dependency to version 0.3.15 or newer. In Python environments, this typically involves running 'pip install --upgrade langgraph-sdk' or updating your requirements.txt/pyproject.toml to reflect version ≥0.3.15. Test the upgrade in a staging environment to confirm compatibility with your existing LangGraph API server version. No database migrations or configuration changes are required; the fix is purely in the SDK's request construction logic. After patching, restart any applications or services using the SDK.

Detection guidance

Monitor HTTP requests to LangGraph API endpoints for anomalous path patterns, particularly those containing URL-encoded special characters (%2F, %2E, %252F) or unusual path segments in identifier positions. Log all SDK method calls that accept user-supplied identifiers and correlate them with the actual HTTP requests sent by the SDK. In upstream gateways or WAFs, inspect the full request path after any path normalization or decoding steps. Search application logs for failed authorization attempts or unexpected resource access patterns. If you have access to SDK debug logging, enable it to capture the actual HTTP paths being constructed.

Why prioritize this

While the CVSS score is moderate (4.2), this vulnerability merits prompt attention because it directly undermines authorization assumptions in many modern deployment patterns. The fix is trivial (a version bump), and the window for exploitation requires credentials plus specific deployment architecture. Prioritize this for teams using LangGraph in multi-tenant SaaS, internal platforms managing user resources, or any environment where identifiers originate from untrusted sources. Organizations using simple, flat resource models or strictly application-level authorization may face lower practical risk.

Risk score, explained

The CVSS 3.1 score of 4.2 (MEDIUM) reflects the requirement for prior authentication (PR:L) and high attack complexity (AC:H), which together constrain exploitability. However, the potential for confidentiality and integrity impact (C:L/I:L) acknowledges that successful exploitation could leak or modify data. The score does not account for deployment-specific factors; organizations relying heavily on URL-prefix-based access control should treat this as higher-priority than the base score suggests.

Frequently asked questions