---
id: "CVE-2026-115885"
kind: "vulnerability"
aliases: ["CVE-2026-115885"]
title: "LangGraph CLI: verbose deploy prints registry push token into logs"
severity: "medium"
cvss: 4.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "ci-cd", "docker", "langgraph", "langgraph-cli", "langgraph-cloud"]
not_affected_if: ["no-verbose-flag", "remote-image-builds", "unversioned-or-patched-cli"]
published_at: "2026-10-23T22:16:57+00:00"
first_seen_at: "2026-10-23T23:44:51+00:00"
updated_at: "2026-10-25T04:41:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115885", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# LangGraph CLI: verbose deploy prints registry push token into logs

Running langgraph deploy with --verbose from 0.4.15 through 0.4.32 echoes a temporary registry push token into command output. Anyone who can read the CI logs or terminal recordings within the token's 12-hour lifetime can pull or push deployment images.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `langgraph --version` and confirm whether it is between `0.4.15` and `0.4.32`.
- Search CI logs and pipeline job histories for `langgraph deploy --verbose` runs made in that version range.
- Check whether any build or deploy job stores terminal recordings or verbose output where non-deployers can read it.

## Fix

- Upgrade the LangGraph CLI to `0.4.32` or later.
- Until upgraded, drop `--verbose` from `langgraph deploy` invocations.
- Treat any registry push token exposed in old verbose logs as compromised and let it expire or rotate it.

## Timeline

- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115885

## From the sources

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_