CVE-2026-104873: LangGraph Python SDK Auth Bypass Flaw

CVE-2026-104873 Overview

CVE-2026-104873 is a broken authorization vulnerability [CWE-863] in the LangGraph Python SDK. The langgraph-sdk is used to connect to running LangGraph API servers and manage assistants, threads, and stream runs from Python applications. Affected versions from 0.1.45 until 0.4.4 contain a flaw in the resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons. These decorators ignore the actions argument and register the selected handler for every action on the resource. An authenticated user can bypass fallback action, ownership, or permission checks and read, update, or delete another user's resource.

Critical Impact
Authenticated users on affected LangGraph deployments can bypass authorization checks to access, modify, or delete resources owned by other users.

Affected Products

LangGraph Python SDK (langgraph-sdk) versions 0.1.45 through 0.4.3
Python deployments using the @auth.on.threads decorator with specific actions
Python deployments using the @auth.on.assistants or @auth.on.crons decorators with specific actions

Discovery Timeline

2026-10-02 - CVE-2026-104873 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104873

Vulnerability Analysis

The vulnerability resides in the resource-scoped authorization decorator logic of the LangGraph Python SDK. Developers use decorators like @auth.on.threads(actions=["read"]) to attach access control handlers to specific operations on a resource. The SDK is expected to invoke the handler only when the request matches both the resource and the specified action.

Instead, the SDK ignores the actions argument entirely. The decorated handler becomes a wildcard handler that registers for every action on the resource type. Because this wildcard resource handler is selected before broader fallback handlers, the fallback checks never execute for other actions.

An authenticated user issuing a request for an action that was expected to flow through a stricter fallback handler instead reaches the narrower, action-specific handler. If that handler does not independently enforce ownership and permission checks for every possible action, the request is authorized incorrectly.

Root Cause

The root cause is incorrect action-to-handler dispatch in the decorator registration logic. The actions parameter is parsed but not applied during handler selection. See the fix in the GitHub Commit Update.

Attack Vector

An authenticated attacker interacts with the LangGraph API server using valid credentials. The attacker issues requests targeting another user's thread, assistant, or cron resource using actions not covered by the registered narrow handler. The wildcard dispatch bypasses fallback ownership checks and returns, modifies, or deletes the targeted resource.

Technical details are available in the GitHub Security Advisory GHSA-fvww-7h3r-vfhp.

Detection Methods for CVE-2026-104873

Indicators of Compromise

Access log entries showing a single authenticated principal reading, updating, or deleting threads, assistants, or crons that belong to other users.
Cross-tenant resource access patterns in LangGraph API server logs where the acting user ID does not match the resource owner ID.
Unexpected DELETE or PATCH operations against assistants and threads shortly after authentication events from unprivileged accounts.

Detection Strategies

Audit the deployed langgraph-sdk version across Python services and flag any version from 0.1.45 through 0.4.3.
Review all usages of @auth.on.threads, @auth.on.assistants, and @auth.on.crons to confirm each handler independently enforces ownership and permission checks for every action it receives.
Correlate API gateway logs with LangGraph application logs to identify requests that reached resource endpoints without passing the expected fallback authorization handler.

Monitoring Recommendations

Enable verbose authorization logging in LangGraph deployments and ingest the logs into a centralized analytics backend.
Alert on API responses where the authenticated principal differs from the resource owner across thread, assistant, and cron endpoints.
Baseline per-user request volumes against resource types and alert on sudden expansion into resources outside the user's historical scope.

How to Mitigate CVE-2026-104873

Immediate Actions Required

Upgrade langgraph-sdk to version 0.4.4 or later on all Python deployments.
Inventory all authorization handlers decorated with @auth.on.threads, @auth.on.assistants, or @auth.on.crons and confirm each performs ownership checks for every action.
Rotate or invalidate any API tokens or session credentials that may have been used to access resources during the exposure window.

Patch Information

The issue is fixed in langgraph-sdk version 0.4.4. See the GitHub Release SDK 0.4.4 for the official release notes and the GitHub Commit Update for the code change that corrects handler dispatch.

Workarounds

Modify affected handlers so they independently enforce all required checks for every action they may receive, including ownership validation.
Replace narrow action-scoped decorators with broader resource decorators that explicitly branch on the action argument inside the handler body.
Restrict API server exposure to trusted authenticated users while the upgrade and handler review are in progress.

bash

# Upgrade the LangGraph Python SDK to the fixed version
pip install --upgrade "langgraph-sdk>=0.4.4"

# Verify the installed version
pip show langgraph-sdk | grep -i version