{"schema":"threatline.record/2","record":{"id":"CVE-2026-115885","aliases":["GHSA-8prr-f582-jqq3"],"summary":"LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output","details":"The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.","categories":["Unclassified"],"product":"langgraph","vendor":"langchain-ai","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115885","source_modified_at":"2026-10-23T21:15:09.944Z","fetched_at":"2026-10-23T21:47:51.402276Z","product":"langgraph","vendor":"langchain-ai","versions":[{"version":">= 0.4.15, < 0.4.32","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":4.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T21:15:09.944Z","modified_at":"2026-10-23T21:15:09.944Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115885","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23T21:15:09.944Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/langchain-ai/langgraph/security/advisories/GHSA-8prr-f582-jqq3","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/langchain-ai/langgraph/pull/8482","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/langchain-ai/langgraph/commit/1afaca35a0d4962fb0203a0e9133a07ffd6a553c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/langchain-ai/langgraph/releases/tag/cli%3D%3D0.4.32.dev0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T21:15:09.944Z","content_hash":"cfa6b8037d863a6eb7766e2c7ee3a4d7a8d5ae3b714d1e1364be87f7c09e1540"}}