langgraph
- Software type
- Application framework
- Total vulnerabilities (90 days)
- 2
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/23/2026, langgraph recorded 2 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of langgraph and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-115885LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputCVE-2026-115883LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesCVE-2026-104873LangGraph SDK custom auth silently ignores actions= on resource decoratorsCVE-2026-71433LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite storesCVE-2026-14742langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-115885LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-115883LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores | Exploitation statusNot confirmed | FixYes | Published10/23/2026 | SeverityMedium |
|---|
CVE-2026-104873LangGraph SDK custom auth silently ignores actions= on resource decorators | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-71433LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores | Exploitation statusNot exploited | FixYes | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-14742langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash | Exploitation statusActively exploited | FixYes | Published07/05/2026 | SeverityLow |
|---|
CVE-2026-48775LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading | Exploitation statusNot exploited | FixYes | Published06/16/2026 | SeverityMedium |
|---|
CVE-2026-28277LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading | Exploitation statusNot exploited | FixNo | Published03/05/2026 | SeverityMedium |
|---|
CVE-2025-67644LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method | Exploitation statusNot exploited | FixYes | Published12/10/2025 | SeverityHigh |
|---|
CVE-2025-64439LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer | Exploitation statusActively exploited | FixYes | Published11/07/2025 | SeverityHigh |
|---|
CVE-2025-64104LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore | Exploitation statusActively exploited | FixYes | Published10/29/2025 | SeverityHigh |
|---|
10 Results | Page 1 of 1