{"items":[{"id":"NVI-00009100","kind":"vulnerability","title":"LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3fx2-cqw9-xr3c","CVE-2026-118667"],"plain_summary":"GitHub lists this reviewed advisory for langgraph-sdk, langgraph. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-190119055dcd18dfde0ef1496f99ef4d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:05:48.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b25018b01419e915d3eb04df48abada4"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.394%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.33624. Missing scores are unknown.","source_id":"sr-190119055dcd18dfde0ef1496f99ef4d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b25018b01419e915d3eb04df48abada4","url":"https://github.com/advisories/GHSA-3fx2-cqw9-xr3c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3fx2-cqw9-xr3c","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"},{"id":"sr-190119055dcd18dfde0ef1496f99ef4d","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-118667","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.375Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b25018b01419e915d3eb04df48abada4"],"technology":"langgraph-sdk","known_exclusions":[],"conditions_summary":"### Summary\n\nThe LangGraph Python SDK v3 streaming client interpolates caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server.\n\n### Details\n\nThe affected `get_tree` and `_fetch_state` implementations build request paths from raw identifiers rather than passing each identifier through the SDK's existing `_quote_path_param` helper. HTTP path normalization can collapse values containing relative segments before dispatch while retaining the client's authentication headers.\n\n`langgraph-sdk` versions 0.4.0 through 0.4.5 are affected. The v3 stream module is not present in the 0.3.x release line.\n\n`RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when used with a vulnerable `langgraph-sdk` version. It passes `config[\"configurable\"][\"thread_id\"]` into `threads.stream(...)`, and its dependency range permits affected SDK versions.\n\n### Impact\n\nAn application is affected only if it passes attacker-controlled text as a streaming `thread_id` or `assistant_id`. In ","public_affected_ranges":[">= 0.4.0, < 0.4.6"]},{"certainty":"source_listed","source_ids":["sr-b25018b01419e915d3eb04df48abada4"],"technology":"langgraph","known_exclusions":[],"conditions_summary":"### Summary\n\nThe LangGraph Python SDK v3 streaming client interpolates caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server.\n\n### Details\n\nThe affected `get_tree` and `_fetch_state` implementations build request paths from raw identifiers rather than passing each identifier through the SDK's existing `_quote_path_param` helper. HTTP path normalization can collapse values containing relative segments before dispatch while retaining the client's authentication headers.\n\n`langgraph-sdk` versions 0.4.0 through 0.4.5 are affected. The v3 stream module is not present in the 0.3.x release line.\n\n`RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when used with a vulnerable `langgraph-sdk` version. It passes `config[\"configurable\"][\"thread_id\"]` into `threads.stream(...)`, and its dependency range permits affected SDK versions.\n\n### Impact\n\nAn application is affected only if it passes attacker-controlled text as a streaming `thread_id` or `assistant_id`. In ","public_affected_ranges":[">= 1.2.3, < 1.2.14"]}],"null_published_at":"2026-10-31T22:27:06.729Z","source_updated_at":"2026-10-28T21:05:48.000Z","source_disclosed_at":"2026-10-28T21:05:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:08.420Z"},{"id":"NVI-00009100","kind":"vulnerability","title":"LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3fx2-cqw9-xr3c","CVE-2026-118667"],"plain_summary":"GitHub lists this reviewed advisory for langgraph-sdk, langgraph. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b25018b01419e915d3eb04df48abada4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:05:48.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b25018b01419e915d3eb04df48abada4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b25018b01419e915d3eb04df48abada4","url":"https://github.com/advisories/GHSA-3fx2-cqw9-xr3c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3fx2-cqw9-xr3c","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b25018b01419e915d3eb04df48abada4"],"technology":"langgraph-sdk","known_exclusions":[],"conditions_summary":"### Summary\n\nThe LangGraph Python SDK v3 streaming client interpolates caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server.\n\n### Details\n\nThe affected `get_tree` and `_fetch_state` implementations build request paths from raw identifiers rather than passing each identifier through the SDK's existing `_quote_path_param` helper. HTTP path normalization can collapse values containing relative segments before dispatch while retaining the client's authentication headers.\n\n`langgraph-sdk` versions 0.4.0 through 0.4.5 are affected. The v3 stream module is not present in the 0.3.x release line.\n\n`RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when used with a vulnerable `langgraph-sdk` version. It passes `config[\"configurable\"][\"thread_id\"]` into `threads.stream(...)`, and its dependency range permits affected SDK versions.\n\n### Impact\n\nAn application is affected only if it passes attacker-controlled text as a streaming `thread_id` or `assistant_id`. In ","public_affected_ranges":[">= 0.4.0, < 0.4.6"]},{"certainty":"source_listed","source_ids":["sr-b25018b01419e915d3eb04df48abada4"],"technology":"langgraph","known_exclusions":[],"conditions_summary":"### Summary\n\nThe LangGraph Python SDK v3 streaming client interpolates caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server.\n\n### Details\n\nThe affected `get_tree` and `_fetch_state` implementations build request paths from raw identifiers rather than passing each identifier through the SDK's existing `_quote_path_param` helper. HTTP path normalization can collapse values containing relative segments before dispatch while retaining the client's authentication headers.\n\n`langgraph-sdk` versions 0.4.0 through 0.4.5 are affected. The v3 stream module is not present in the 0.3.x release line.\n\n`RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when used with a vulnerable `langgraph-sdk` version. It passes `config[\"configurable\"][\"thread_id\"]` into `threads.stream(...)`, and its dependency range permits affected SDK versions.\n\n### Impact\n\nAn application is affected only if it passes attacker-controlled text as a streaming `thread_id` or `assistant_id`. In ","public_affected_ranges":[">= 1.2.3, < 1.2.14"]}],"null_published_at":"2026-10-31T22:13:31.276Z","source_updated_at":"2026-10-28T21:05:48.000Z","source_disclosed_at":"2026-10-28T21:05:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:08.420Z"}],"next_cursor":null,"snapshot_revision":"42594"}