Summary
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
In affected versions of langgraph-api (the LangGraph Server runtime), a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the authentication middleware treats as internal and does not authenticate. As a result, a relative webhook target could reach the server's own routes that operate on threads and runs without the authentication context that applies to ordinary external requests.
In deployments that scope threads and runs by owner, this could allow a request associated with one user to reach routes operating on another user's thread, resulting in creation of a run on (or modification of the state of) a thread owned by another user, even where the corresponding direct external requests were correctly denied. Limited metadata from the targeted thread may be incorporated into the created run record.
We have no evidence of this behavior occurring in the wild.
Affected users / systems
You may be affected if you:
- run
langgraph-api(the LangGraph Server / Agent Server runtime, including via the LangGraph Platform Helm chart), - allow runs or crons to specify webhook targets, and
- rely on per-user authorization to separate threads and runs between users.
Patches / mitigation
The webhook URL policy now denies loopback delivery by default: the webhooks.url.disable_loopback policy defaults to enabled. This covers relative webhook targets routed through the in-process transport, as well as localhost-style hostnames, loopback address ranges, and hostnames that resolve into the loopback range. Deployments that legitimately deliver webhooks to a route hosted on the same process can opt back in by setting webhooks.url.disable_loopback: false in langgraph.json (or the equivalent LANGGRAPH_WEBHOOKS configuration); do so only when you control the routes those webhooks reach, as they are delivered without authentication. Fixed in langgraph-api 0.10.0.
Operational guidance
- Upgrade to a release containing this change and keep loopback webhook delivery disabled unless required.
- If loopback delivery is enabled, restrict it to routes you control and apply authorization within those routes.
Impact
- Integrity: creation of a run on, or modification of the state of, a thread owned by another user, beyond the requesting user's authorization scope.
- Confidentiality: limited exposure of another user's thread metadata, incorporated into the created run record.
The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.
CVE-2026-55235 has a CVSS score of 5.9 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.10.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-55235? CVE-2026-55235 is a medium-severity improper authentication vulnerability in langgraph-api (pip), affecting versions < 0.10.0. It is fixed in 0.10.0. The application does not adequately verify the identity of a user, device, or process before granting access.
- How severe is CVE-2026-55235? CVE-2026-55235 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of langgraph-api are affected by CVE-2026-55235? langgraph-api (pip) versions < 0.10.0 is affected.
- Is there a fix for CVE-2026-55235? Yes. CVE-2026-55235 is fixed in 0.10.0. Upgrade to this version or later.
- Is CVE-2026-55235 exploitable, and should I be worried? Whether CVE-2026-55235 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-55235 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-55235? Upgrade
langgraph-apito 0.10.0 or later.