Tools AI Risk Radar ai-incident-0189
Incident record
LangGraph SDK fixes action-level authorisation bypass
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- LangGraph Python SDK from 0.1.45 through 0.4.3
- Actor
- researcher
- CVE
- CVE-2026-104873
What happened
An authorisation handler intended for selected actions could apply more broadly and bypass a fallback permission check. An authenticated caller could gain access where the application’s handler omitted equivalent checks.
Version 0.4.4 fixes the actions restriction. The maintainer published the advisory on 28 August; the global CVE entry followed on 5 October. It scores the vulnerability 7.6 High under CVSS 4.0.
Sources
- Primary disclosuregithub.com/langchain-ai/langgraph/security/advisories/GHSA-f…
- Supporting primary sourcegithub.com/advisories/GHSA-fvww-7h3r-vfhp
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026