Live › vulnerability › CVE-2026-115885
Go to dashboardRunning langgraph deploy with --verbose from 0.4.15 through 0.4.32 echoes a temporary registry push token into command output. Anyone who can read the CI logs or terminal recordings within the token's 12-hour lifetime can pull or push deployment images.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 23:44 UTC. All times on this page are UTC.
Teams that run with a local image build, so the registry push token passes through the CLI's logged subprocess. Exposure depends on who can read those CI logs or terminal recordings before the 12-hour token expiry. Deployments without --verbose and remote image builds are not affected.
langgraph deploy --verboseNo product ranges from the sources yet.
langgraph --version and confirm whether it is between 0.4.15 and 0.4.32.langgraph deploy --verbose runs made in that version range.0.4.32 or later.--verbose from langgraph deploy invocations.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.
This page as .md · .json · in your agent: get_signal("CVE-2026-115885")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.