{"id":"CVE-2026-115885","kind":"vulnerability","aliases":["CVE-2026-115885"],"related":[],"title":"LangGraph CLI: verbose deploy prints registry push token into logs","description":"The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.","summary":"Running langgraph deploy with --verbose from 0.4.15 through 0.4.32 echoes a temporary registry push token into command output. Anyone who can read the CI logs or terminal recordings within the token's 12-hour lifetime can pull or push deployment images.","severity":"medium","cvss":4.1,"epss":0.00161,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","ci-cd","docker","langgraph","langgraph-cli","langgraph-cloud"],"not_affected_if":["no-verbose-flag","remote-image-builds","unversioned-or-patched-cli"],"how_to_check":"- Run `langgraph --version` and confirm whether it is between `0.4.15` and `0.4.32`.\n- Search CI logs and pipeline job histories for `langgraph deploy --verbose` runs made in that version range.\n- Check whether any build or deploy job stores terminal recordings or verbose output where non-deployers can read it.","fix":"- Upgrade the LangGraph CLI to `0.4.32` or later.\n- Until upgraded, drop `--verbose` from `langgraph deploy` invocations.\n- Treat any registry push token exposed in old verbose logs as compromised and let it expire or rotate it.","status":"open","published_at":"2026-10-23T22:16:57+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","triaged_at":"2026-10-25T04:41:47+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:41:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the LangGraph CLI to `0.4.32` or later.\n- Until upgraded, drop `--verbose` from `langgraph deploy` invocations.\n- Treat any registry push token exposed in old verbose logs as compromised and let it expire or rotate it.","reach":"unknown","title":"LangGraph CLI: verbose deploy prints registry push token into logs","impact":"medium","summary":"Running langgraph deploy with --verbose from 0.4.15 through 0.4.32 echoes a temporary registry push token into command output. Anyone who can read the CI logs or terminal recordings within the token's 12-hour lifetime can pull or push deployment images.","category":"ai-tooling","nicknames":[],"who_cares":["langgraph","langgraph-cli","ci-cd","docker","langgraph-cloud"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attackers pull or push deployment images using a leaked short-lived token","analyst_note":"","how_to_check":"- Run `langgraph --version` and confirm whether it is between `0.4.15` and `0.4.32`.\n- Search CI logs and pipeline job histories for `langgraph deploy --verbose` runs made in that version range.\n- Check whether any build or deploy job stores terminal recordings or verbose output where non-deployers can read it.","needs_analyst":false,"not_affected_if":["no-verbose-flag","remote-image-builds","unversioned-or-patched-cli"],"who_is_affected":"Teams that run `langgraph deploy --verbose` with a local image build, so the registry push token passes through the CLI's logged subprocess. Exposure depends on who can read those CI logs or terminal recordings before the 12-hour token expiry. Deployments without --verbose and remote image builds are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":3415,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115885':13A,16A '-2026':12A,15A '0.4.15':37B,85C '0.4.32':39B,87C,177C '12':63B,132C 'affect':157C 'ai':18B 'ai-tool':17B 'alon':161C 'anyon':49B,117C 'build':154C 'cannot':162C 'cd':22B 'ci':21B,54B,122C 'ci-cd':20B 'cli':2A,27B,74C,108C 'cloud':30B 'command':47B,79C,112C 'command-lin':78C 'cve':11A,14A 'deploy':4A,33B,70B,89C,137C,144C,148C,165C 'docker':23B,101C 'echo':40B 'execut':167C 'expir':134C 'fix':174C 'helper':110C 'hour':64B,133C 'imag':71B,138C,141C,146C,153C,170C 'input':99C,113C 'interfac':81C 'issu':172C 'langgraph':1A,24B,26B,29B,32B,73C,83C,88C 'langgraph-c':25B 'langgraph-cloud':28B 'lifetim':65B 'line':80C 'log':10A,55B,123C 'login':102C 'maximum':131C 'mode':116C 'offici':77C 'output':48B 'pass':91C 'password':104C 'password-stdin':103C 'print':5A,111C 'pull':67B,136C 'push':7A,44B,69B,95C,140C,169C 'read':52B,120C 'record':58B,126C 'registri':6A,43B,94C 'remot':152C 'repositori':147C 'result':121C 'run':31B 'standard':98C 'stdin':105C 'subprocess':109C 'temporari':42B,93C 'termin':57B,125C 'token':8A,45B,61B,96C,129C,160C 'tool':19B 'updat':163C 'verbos':3A,35B,90C,115C,150C 'version':176C 'within':59B 'without':149C","nicknames":[],"mitigations":[],"who_affected":"Teams that run `langgraph deploy --verbose` with a local image build, so the registry push token passes through the CLI's logged subprocess. Exposure depends on who can read those CI logs or terminal recordings before the 12-hour token expiry. Deployments without --verbose and remote image builds are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T22:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115885","severity":null,"published_at":"2026-10-23T22:16:57+00:00","modified_at":"2026-10-23T22:16:57+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115885","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115885","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}