Summary
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
The LangGraph Python SDK v3 streaming client interpolates caller-supplied thread_id and assistant_id values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server.
Details
The affected get_tree and _fetch_state implementations build request paths from raw identifiers rather than passing each identifier through the SDK's existing _quote_path_param helper. HTTP path normalization can collapse values containing relative segments before dispatch while retaining the client's authentication headers.
langgraph-sdk versions 0.4.0 through 0.4.5 are affected. The v3 stream module is not present in the 0.3.x release line.
RemoteGraph v3 streaming in langgraph 1.2.3 and later is also affected when used with a vulnerable langgraph-sdk version. It passes config["configurable"]["thread_id"] into threads.stream(...), and its dependency range permits affected SDK versions.
Impact
An application is affected only if it passes attacker-controlled text as a streaming thread_id or assistant_id. In that configuration, an attacker may select another readable path on the configured server and cause the SDK to return that response to the application. Through thread_id, the attacker can also control the query string, for example by targeting /store/items?namespace=...&key=...; assistant_id controls only the path. The affected requests are GET operations, so this issue does not provide a write primitive.
The LangGraph Platform is not exposed to this issue.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-118667 has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.4.6, 1.2.14); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade langgraph-sdk to version 0.4.6 or later. The fix encodes assistant_id in get_tree and thread_id in _fetch_state with _quote_path_param in both synchronous and asynchronous stream modules.
If you use RemoteGraph, also upgrade langgraph to version 1.2.14 or later, which requires langgraph-sdk>=0.4.6.
Frequently Asked Questions
- What is CVE-2026-118667? CVE-2026-118667 is a medium-severity path traversal vulnerability in langgraph-sdk (pip), affecting versions >= 0.4.0, < 0.4.6. It is fixed in 0.4.6, 1.2.14. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- How severe is CVE-2026-118667? CVE-2026-118667 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which packages are affected by CVE-2026-118667?
langgraph-sdk(pip) (versions >= 0.4.0, < 0.4.6)langgraph(pip) (versions >= 1.2.3, < 1.2.14)
- Is there a fix for CVE-2026-118667? Yes. CVE-2026-118667 is fixed in 0.4.6, 1.2.14. Upgrade to this version or later.
- Is CVE-2026-118667 exploitable, and should I be worried? Whether CVE-2026-118667 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-118667 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-118667?
- Upgrade
langgraph-sdkto 0.4.6 or later - Upgrade
langgraphto 1.2.14 or later
- Upgrade