{"schema":"threatline.record/2","record":{"id":"CVE-2026-55236","aliases":["GHSA-jfj5-wrj9-63x4","PYSEC-2026-3858"],"summary":"langgraph-api: Incomplete assistant authorization in LangGraph Server run creation","details":"## Summary\n\nIn affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the `assistants.read` authorization event; run creation dispatched `assistants.search` with an incomplete value. In deployments whose custom authorization handlers register only an `assistants.read` handler (without an `assistants.search` handler and without a global fallback handler), no handler was consulted on the run-creation path, the returned filter set was empty, and the owner constraint was omitted from the resulting query.\n\nAs a result, in those deployments a request to create a run could reference a private assistant owned by another user, even where direct assistant reads, assistant search, and cron creation against that assistant were correctly denied. The run-creation response merged the referenced assistant's `metadata`, `config`, and `context` into fields returned to the requesting user. These fields can carry sensitive configuration; the runtime encrypts them at rest for that reason.\n\nWe have no evidence of this behavior occurring in the wild.\n\n## Affected users / systems\n\nYou may be affected if you:\n\n- run `langgraph-api` (the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), and\n- use custom authorization handlers that gate assistant access through an `assistants.read` or `assistants.search` handler rather than a global handler covering all assistant events.\n\nDeployments without custom authorization handlers, or whose handlers apply an equivalent owner filter across all assistant events (for example through a global handler), are not affected.\n\n## Impact\n\n- Confidentiality: exposure of another user's private assistant `metadata`, `config`, and `context` through the run-creation response. These fields can contain sensitive configuration.\n- Integrity: creation of a run associated with another user's private assistant, beyond the requesting user's authorization scope; the run is then carried out using that assistant's configuration.\n\n## Patches / mitigation\n\nRun creation, and the parallel cron-creation path, now dispatch the `assistants.read` authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Client-supplied run and cron metadata is no longer forwarded into that authorization event, so handlers receive a consistent value shape and determine access by returning an owner filter that is applied server-side. Fixed in `langgraph-api` 0.10.0.\n\nThis is a behavioral change for deployments with custom authorization handlers:\n\n- Handlers that gated assistant access only through `assistants.search` during run creation are no longer consulted on that path; provide an equivalent `assistants.read` handler that returns the same owner filter.\n- The metadata field on the `assistants.read` event during run and cron creation is no longer populated; handlers that read or stamped it should move that logic into the run/cron create handlers.\n\n## Operational guidance\n\n- Register an `assistants.read` handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.\n- Upgrade to a release containing this change.","categories":["Libraries & packages"],"product":"langgraph-api","vendor":"langchain-ai","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jfj5-wrj9-63x4","source_modified_at":"2026-10-28T21:08:12Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"pip","name":"langgraph-api"},"range":"< 0.10.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55236","source_modified_at":"2026-09-14T16:42:03.499Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"langgraph-api","vendor":"langchain-ai","versions":[{"version":"< 0.10.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jfj5-wrj9-63x4","source_modified_at":"2026-10-28T21:15:04.217838596Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"name":"langgraph-api","ecosystem":"PyPI","purl":"pkg:pypi/langgraph-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.28rc1","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.12","0.1.13"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jfj5-wrj9-63x4","source_modified_at":"2026-10-28T21:08:12Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"pip","name":"langgraph-api"},"version":"0.10.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jfj5-wrj9-63x4","source_modified_at":"2026-10-28T21:15:04.217838596Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"name":"langgraph-api","ecosystem":"PyPI","purl":"pkg:pypi/langgraph-api"},"version":"0.10.0"}],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00255,"percentile":0.1712,"score_date":"2026-10-28"},"published_at":"2026-09-14T15:51:17.118Z","modified_at":"2026-10-28T21:15:04.217838596Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-jfj5-wrj9-63x4","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:08:12Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-55236","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-09-14T16:42:03.499Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-jfj5-wrj9-63x4","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:15:04.217838596Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55236","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/langchain-ai/helm/security/advisories/GHSA-jfj5-wrj9-63x4","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55236","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/langchain-ai/docs/blob/7b70fbacab21f84d9c6f9848f86cdeb471adbb50/src/langsmith/agent-server-changelog.mdx","tags":["x_refsource_MISC"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/langgraph-api/PYSEC-2026-3858.yaml","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-jfj5-wrj9-63x4","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-14T16:41:45.325753Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T21:15:04.217838596Z","content_hash":"c51e670145099138f4260b8293495f1a1a96023d26f4cf46ad56cf8592668004"}}