{"id":"CVE-2026-55236","kind":"vulnerability","aliases":["CVE-2026-55236","GHSA-jfj5-wrj9-63x4"],"related":[],"title":"langgraph-api: Incomplete assistant authorization in LangGraph Server run creation","description":"## Summary\n\nIn affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the `assistants.read` authorization event; run creation dispatched `assistants.search` with an incomplete value. In deployments whose custom authorization handlers register only an `assistants.read` handler (without an `assistants.search` handler and without a global fallback handler), no handler was consulted on the run-creation path, the returned filter set was empty, and the owner constraint was omitted from the resulting query.\n\nAs a result, in those deployments a request to create a run could reference a private assistant owned by another user, even where direct assistant reads, assistant search, and cron creation against that assistant were correctly denied. The run-creation response merged the referenced assistant's `metadata`, `config`, and `context` into fields returned to the requesting user. These fields can carry sensitive configuration; the runtime encrypts them at rest for that reason.\n\nWe have no evidence of this behavior occurring in the wild.\n\n## Affected users / systems\n\nYou may be affected if you:\n\n- run `langgraph-api` (the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), and\n- use custom authorization handlers that gate assistant access through an `assistants.read` or `assistants.search` handler rather than a global handler covering all assistant events.\n\nDeployments without custom authorization handlers, or whose handlers apply an equivalent owner filter across all assistant events (for example through a global handler), are not affected.\n\n## Impact\n\n- Confidentiality: exposure of another user's private assistant `metadata`, `config`, and `context` through the run-creation response. These fields can contain sensitive configuration.\n- Integrity: creation of a run associated with another user's private assistant, beyond the requesting user's authorization scope; the run is then carried out using that assistant's configuration.\n\n## Patches / mitigation\n\nRun creation, and the parallel cron-creation path, now dispatch the `assistants.read` authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Client-supplied run and cron metadata is no longer forwarded into that authorization event, so handlers receive a consistent value shape and determine access by returning an owner filter that is applied server-side. Fixed in `langgraph-api` 0.10.0.\n\nThis is a behavioral change for deployments with custom authorization handlers:\n\n- Handlers that gated assistant access only through `assistants.search` during run creation are no longer consulted on that path; provide an equivalent `assistants.read` handler that returns the same owner filter.\n- The metadata field on the `assistants.read` event during run and cron creation is no longer populated; handlers that read or stamped it should move that logic into the run/cron create handlers.\n\n## Operational guidance\n\n- Register an `assistants.read` handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.\n- Upgrade to a release containing this change.","summary":"langgraph-api (the LangGraph Server runtime) used a different authorization event on run creation than on other assistant paths, so custom handlers that only registered assistants.read left the owner filter empty. An authenticated user could create a run against another user's private assistant and receive that assistant's metadata, config and context in the response.","severity":"medium","cvss":5.9,"epss":0.00255,"exploited":false,"exploited_at":null,"products":[{"name":"langgraph-api","fixed":["0.10.0"],"affected":"< 0.10.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-agents","ai-tooling","cwe-285","kubernetes","langgraph","python","self-hosted"],"not_affected_if":["default-config","global-auth-handler","no-custom-auth-handlers"],"how_to_check":"- Run `pip show langgraph-api` and confirm the version is below `0.10.0`\n- Search your authorization handler code for `assistants.read` and `assistants.search` registrations; if there is no `assistants.search` handler and no global handler, you are in the affected configuration\n- Test that a user cannot POST a run referencing another user's private assistant ID","fix":"- Upgrade `langgraph-api` to `0.10.0` or later\n- Register an `assistants.read` handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across assistant read, search, and run/cron creation\n- Move any logic that read or stamped the metadata field on the assistants.read event during run and cron creation into the run/cron create handlers","status":"open","published_at":"2026-08-19T18:56:03+00:00","first_seen_at":"2026-10-28T21:12:45+00:00","triaged_at":"2026-10-28T21:13:47+00:00","updated_at":"2026-10-28T21:13:47+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-28T21:13:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `langgraph-api` to `0.10.0` or later\n- Register an `assistants.read` handler (or a global handler covering it) that returns an owner-style filter, and confirm parity across assistant read, search, and run/cron creation\n- Move any logic that read or stamped the metadata field on the assistants.read event during run and cron creation into the run/cron create handlers","reach":"internet","title":"LangGraph Server: run creation exposes another user's private assistant config","impact":"medium","summary":"langgraph-api (the LangGraph Server runtime) used a different authorization event on run creation than on other assistant paths, so custom handlers that only registered assistants.read left the owner filter empty. An authenticated user could create a run against another user's private assistant and receive that assistant's metadata, config and context in the response.","category":"ai-tooling","nicknames":[],"who_cares":["langgraph","python","self-hosted","kubernetes","ai-agents"],"confidence":0.8,"needs_auth":"yes","worst_case":"another user's private assistant config is readable and runs use it","analyst_note":"","how_to_check":"- Run `pip show langgraph-api` and confirm the version is below `0.10.0`\n- Search your authorization handler code for `assistants.read` and `assistants.search` registrations; if there is no `assistants.search` handler and no global handler, you are in the affected configuration\n- Test that a user cannot POST a run referencing another user's private assistant ID","needs_analyst":false,"not_affected_if":["default-config","global-auth-handler","no-custom-auth-handlers"],"who_is_affected":"Deployments running langgraph-api below 0.10.0 that use custom authorization handlers gating assistant access through assistants.read or assistants.search rather than a global handler. Deployments without custom authorization handlers, or whose handlers apply an owner filter across all assistant events, are not affected. Look at the LangGraph Server and Agent Server runtime, including installs through the LangGraph Platform Helm chart.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000793,"input_tokens":4310,"output_tokens":725,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-285':33B '-55236':14A,22A '0.10.0':488C '63x4':19A 'access':320C,471C,504C 'across':349C,582C 'affect':99C,286C,292C,361C 'agent':28B,302C 'ai':27B,30B 'ai-ag':26B 'ai-tool':29B 'anoth':80B,221C,366C,394C 'api':3A,25A,42B,104C,298C,487C 'appli':344C,479C 'assist':5A,58B,84B,88B,116C,132C,137C,218C,226C,228C,235C,247C,319C,334C,351C,370C,398C,414C,445C,503C,584C 'assistant-handl':131C 'assistants.read':66B,144C,164C,323C,431C,521C,534C,564C 'assistants.search':150C,168C,325C,507C 'associ':392C 'attach':117C 'authent':73B 'author':6A,50B,114C,124C,145C,159C,315C,339C,404C,432C,460C,498C 'behavior':281C,492C 'beyond':399C 'carri':263C,410C 'chang':493C,597C 'chart':311C 'client':448C 'client-suppli':447C 'code':134C 'confidenti':363C 'config':91B,250C,372C 'configur':265C,386C,416C 'confirm':580C 'consist':466C 'constraint':195C 'consult':179C,514C 'contain':384C,595C 'context':93B,252C,374C 'correct':237C 'could':75B,214C 'cover':332C,570C 'creat':76B,211C,558C 'creation':11A,54B,112C,141C,148C,184C,232C,242C,379C,388C,420C,426C,510C,540C,589C 'cron':140C,231C,425C,452C,539C 'cron-creat':424C 'custom':61B,158C,314C,338C,497C 'cve':12A,20A 'cwe':32B 'deni':238C 'deploy':156C,207C,336C,495C 'determin':470C 'differ':49B,123C 'direct':136C,225C,444C 'dispatch':142C,149C,429C 'empti':71B,191C 'encrypt':268C 'equival':346C,520C 'even':223C 'event':51B,125C,146C,335C,352C,433C,461C,535C 'evid':278C 'exampl':354C 'exposur':364C 'fallback':174C 'field':254C,261C,382C,531C 'filter':70B,188C,348C,476C,528C,578C 'fix':483C 'forward':457C 'gate':318C,502C 'ghsa':16A 'ghsa-jfj5-wrj9-63x4':15A 'global':173C,330C,357C,568C 'grpc/postgres':441C 'guidanc':561C 'handl':133C 'handler':62B,160C,165C,169C,175C,177C,316C,326C,331C,340C,343C,358C,463C,499C,500C,522C,545C,559C,565C,569C 'helm':310C 'host':39B 'impact':362C 'in-memori':437C 'includ':305C 'incomplet':4A,153C 'integr':387C 'jfj5':17A 'kubernet':34B 'langgraph':2A,8A,24A,35B,41B,44B,103C,106C,297C,300C,308C,486C 'langgraph-api':1A,23A,40B,102C,296C,485C 'left':67B 'logic':554C 'longer':456C,513C,543C 'match':443C 'may':290C 'memori':439C 'merg':244C 'metadata':90B,249C,371C,453C,530C 'mitig':418C 'move':552C 'occur':282C 'omit':197C 'oper':560C 'own':219C 'owner':69B,194C,347C,475C,527C,576C 'owner-styl':575C 'parallel':423C 'pariti':581C 'patch':417C 'path':59B,113C,135C,185C,427C,517C,590C 'platform':309C 'popul':544C 'privat':83B,217C,369C,397C 'provid':518C 'python':36B 'queri':201C 'rather':327C 'read':138C,227C,446C,547C,585C 'reason':274C 'receiv':86B,464C 'refer':215C 'referenc':246C 'regist':65B,161C,562C 'releas':594C 'request':209C,258C,401C 'respons':96B,243C,380C 'rest':128C,271C 'result':200C,204C 'return':187C,255C,473C,524C,573C 'run':10A,53B,78B,111C,120C,147C,183C,213C,241C,295C,378C,391C,407C,419C,450C,509C,537C 'run-creat':110C,182C,240C,377C 'run/cron':557C,588C 'runtim':46B,108C,267C,304C,442C 'scope':405C 'search':229C,586C 'self':38B 'self-host':37B 'sensit':264C,385C 'server':9A,45B,107C,301C,303C,481C 'server-sid':480C 'set':189C 'shape':468C 'side':482C 'stamp':549C 'style':577C 'summari':97C 'suppli':449C 'system':288C 'tool':31B 'upgrad':591C 'use':47B,121C,313C,412C 'user':74B,81B,222C,259C,287C,367C,395C,402C 'valu':154C,467C 'version':100C 'via':306C 'whose':157C,342C 'wild':285C 'without':166C,171C,337C 'wrj9':18A","nicknames":[],"mitigations":[],"who_affected":"Deployments running langgraph-api below 0.10.0 that use custom authorization handlers gating assistant access through assistants.read or assistants.search rather than a global handler. Deployments without custom authorization handlers, or whose handlers apply an owner filter across all assistant events, are not affected. Look at the LangGraph Server and Agent Server runtime, including installs through the LangGraph Platform Helm chart.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-19T18:56:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jfj5-wrj9-63x4","url":"https://github.com/advisories/GHSA-jfj5-wrj9-63x4","severity":"medium","published_at":"2026-08-19T18:56:03+00:00","modified_at":"2026-10-28T21:08:12+00:00","first_seen_at":"2026-10-28T21:12:45+00:00","fetched_at":"2026-10-28T21:12:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55236","severity":null,"published_at":"2026-09-14T16:17:12+00:00","modified_at":"2026-09-30T19:57:08+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}